The Play ransomware group was spotted exploiting another little-known SSRF bug to trigger RCE on affected Exchange servers.