SharePoint Is On Fire, Proxmox Is Everywhere, and Google Wants to Hack Your Vulnerabilities Before the Bad Guys Do

A critical SharePoint RCE is being actively weaponized right now — patch it before you finish reading this.

Patch SharePoint Now — CVE-2026-50522 Is Being Actively Exploited and the PoC Is Public

This one is not a "schedule it for next patch cycle" situation. watchTowr confirmed active exploitation of CVE-2026-50522, a critical remote code execution flaw in SharePoint, and the public proof-of-concept is already in the wild. Attackers aren't just popping shells — they're stealing machine keys, which means persistent access that survives patching if you don't remediate properly.

Here's what you need to do today:

1. Apply Microsoft's patch immediately. If your SharePoint is on-prem and unpatched, assume you're a target.
2. Rotate your machine keys. Even if you patch, stolen machine keys can be used to forge authentication tokens. Microsoft has guidance on regenerating these — follow it.
3. Hunt for indicators of compromise before you patch. Check IIS logs for unusual POST requests to SharePoint endpoints and look for unexpected scheduled tasks or new local admin accounts.
4. If you're on SharePoint Online, Microsoft handles patching, but audit your third-party integrations and connected apps anyway.

The combination of a public PoC and machine-key theft for persistence is exactly the playbook ransomware operators love. This affects a huge number of organizations — law firms, municipalities, healthcare, manufacturing — all the verticals common in Upstate SC. Don't sleep on this one.

Full details at The Hacker News

Steam Streaming in a Proxmox LXC — No GPU Passthrough Required

If you've been putting off turning your home server into a game streaming box because you dreaded the VFIO/IOMMU passthrough rabbit hole, this XDA write-up is worth your time. The author runs Steam on a Proxmox LXC container on an AMD Strix Halo machine and streams games without dedicating the GPU to a single VM.

The trick: LXC containers share the host kernel, so you can pass the GPU device into the container without the full VFIO driver isolation dance. You're not doing hardware virtualization — you're doing containerized access to the GPU. That means no IOMMU group wrestling, no vfio-pci driver binding, and no praying your setup survives a kernel update.

The tradeoff is real: LXC containers are less isolated than VMs. You're giving that container elevated access to host hardware. For a home lab game server that's also running other workloads, think carefully about your security posture. I wouldn't run this alongside containers that have access to sensitive data without at least putting them on separate bridges and tightening up AppArmor profiles.

That said, for a dedicated streaming box or a machine where gaming is the primary workload? This is a genuinely elegant solution. The author's setup is reproducible and the config snippets are practical. If you've got an old mini PC or a spare NUC collecting dust, this just got more interesting.

Full write-up at XDA

Veeam Moov: Finally, a Sane Way to Migrate Off VMware

If you're in the middle of a VMware exodus — and in 2026, who isn't at least thinking about it — Veeam just made the workload migration piece significantly less painful. Moov is a new tool from the Veeam community that lets you migrate workloads directly from existing Veeam backups onto Proxmox, oVirt, or HPE VM Essentials. No re-backup, no manual export/import cycle, no doing it one VM at a time while your team loses the will to live.

The core value proposition: your Veeam backups are already there. Moov treats them as the migration source and handles the conversion and transfer to your target hypervisor. For shops that have been running Veeam for years, this removes the biggest friction point in the VMware-to-Proxmox path — you're not starting from scratch, you're leveraging infrastructure you already have.

A few things to validate before you go all-in: test restores on non-critical VMs first, verify that your application-consistent snapshots translate cleanly, and confirm licensing implications for Veeam on your new platform. Proxmox migrations in particular can have quirks around virtio drivers that you'll want to catch in a test run rather than a production cutover.

This is the kind of tooling that makes the VMware migration conversation with management a lot easier. "We can use our existing backups" is a compelling sentence.

Community post at Veeam

Your Old Mini PC + Proxmox = A NAS OS You Don't Have to Pay For

This XDA piece makes a case I've made to more than a few people in this community: Proxmox VE on a repurposed mini PC is a legitimate, cost-effective alternative to paid NAS operating systems, and it punches well above its weight class.

The argument is straightforward. Proxmox is AGPL-licensed and fully featured without a paid license — clustering, backups via Proxmox Backup Server, ZFS support, LXC containers, full VMs, the works. The enterprise repository requires a subscription, but the no-subscription repo works fine for home lab use. You're not getting a crippled free tier; you're getting the whole product.

Where this gets interesting for networking folks: run your NAS workload as an LXC container or VM, then run your DNS (Pi-hole or AdGuard), your network monitoring (Grafana + InfluxDB), your VPN endpoint, and your home automation stack on the same box. A $150 used mini PC becomes a surprisingly capable infrastructure node.

The author specifically calls out that Proxmox's web UI has matured to the point where it's genuinely pleasant to use — and I'd agree. If you haven't touched it in a couple of years, it's worth a fresh look. The storage management and backup scheduling in particular have gotten much cleaner.

Full article at XDA

Google's New Gemini Models Are Gunning for Cybersecurity — Here's Why That Matters

Google dropped three new Gemini models yesterday, and the cybersecurity angle is the one worth paying attention to. Google is explicitly positioning these against Anthropic and OpenAI, both of which have been making serious moves in security-focused AI this year — think automated vulnerability discovery and code analysis at scale.

For practitioners, this is the trend that matters: AI systems that can identify security vulnerabilities in software are getting genuinely capable, and they're becoming accessible. That cuts both ways. Defenders can use them to audit codebases and surface weaknesses faster than any manual review process. Attackers can use them to find exploitable bugs in targets.

Google's cybersecurity-focused Gemini capabilities are reportedly aimed at enterprise security teams — think integration with Chronicle, automated threat analysis, and vulnerability research assistance. Whether it delivers on that in practice will take a few months of real-world use to evaluate.

My take: the AI security tooling space is moving fast enough that if you're a security practitioner and you haven't experimented with any of these models for threat analysis or log review workflows, you're falling behind on understanding what your adversaries have access to. That's reason enough to pay attention, even if you're not ready to integrate it into production workflows yet.

Full story at NYT

Want this in your inbox? Subscribe here · Follow on LinkedIn