Tag

#play-ransomware

1 post tagged #play-ransomware.

Analysis · May 20, 2026 · Colten Anderson

A mitigation blocks a path. OWASSRF found another door.

After ProxyNotShell, Microsoft told Exchange admins to apply URL-rewrite mitigations while the patch was finished. OWASSRF (CVE-2022-41080) walked around them by knocking on OWA instead of Autodiscover, and Play ransomware walked in. Mitigations aren't fixes.