ToolShell Stole SharePoint Machine Keys That Survived the Patch

A distinguishing feature of the July 2025 SharePoint exploitation was that attackers extracted cryptographic machine keys from compromised servers. Remediation therefore required both applying the update and rotating those keys. An organisation that only applied the update remained reachable.

The distinction sounds obvious and is routinely lost. An update closes the route by which an attacker entered. It does nothing about what the attacker took while inside, and it does nothing about access established through means the update does not touch.

Stolen key material is the sharpest form of that gap. Keys are trusted by design; they authenticate rather than exploit. Using one produces no anomaly, triggers no signature and appears in no vulnerability scan. The server is correctly patched, correctly configured, reporting green, and serving an attacker.

Vulnerability management is measured in patch coverage: what proportion of the estate is current. It is the number reported to boards and the number regulators ask for.

That metric could not distinguish an organisation that patched from one that patched and rotated. Both show 100%. One is remediated and one is not, and the difference is invisible to the instrument that governs the entire discipline.

This desk filed the limits of patch-centric defence at 26-0405 as a capacity problem — too many defects, not enough hands. This is a different and more troubling limit: even perfect execution of the patch process leaves the compromise in place.

Rotating machine keys invalidates existing sessions, breaks integrations that hold cached material, and requires coordinated restarts. It is a change-controlled outage, in an estate self-hosted precisely because it is entangled with things that cannot easily be disturbed.

So the guidance said patch and rotate, and the second half competed against the same operational constraints described at 25-0729. The organisations most likely to skip it are the ones whose estates are most tangled — which is the same population most likely to have been running the software on premises in the first place.