Overview

• Microsoft confirmed it has stopped sending proof‑of‑concept exploit code to some MAPP participants, explicitly including companies in China, and will provide general written summaries instead.
• The change follows rapid, large‑scale exploitation of two SharePoint zero‑days (CVE‑2025‑53770 and CVE‑2025‑53771) that compromised more than 400 on‑premises servers worldwide.
• Microsoft has publicly tied the activity to China‑linked groups Linen Typhoon and Violet Typhoon, with Storm‑2603 also observed using the flaws, while Beijing has issued a denial.
• Security researchers flagged the timing of MAPP alerts on June 24, July 3, and July 7 against first observed attacks on July 7, prompting suspicions of a leak from within the program.
• Microsoft says its internal review is ongoing and declined to identify restricted firms, while emphasizing it can suspend or remove participants found to violate program rules.