ProxyShell: the Exchange patches came months ago

At Black Hat last week, a researcher presented ProxyShell, a chain of three Exchange Server bugs that gives remote code execution. Microsoft fixed them in the April and May updates. Since the talk, attackers are scanning the internet for servers that never installed them.

After ProxyLogon in March, this is the second big Exchange wave this year.

1. Check your Exchange build number against Microsoft’s list. If it’s older than the May 2021 updates, patch today.
2. Look for web shells in the Exchange web folders and unexpected files created recently.
3. Check for new mailbox export requests and odd admin accounts.
4. Install cumulative updates on a schedule, not only when there’s news.

Running your own Exchange server means patching like the internet is watching. Because it is.