InfoSecBulletin Cybersecurity for mankind
Security researchers warn that hackers are exploiting a critical vulnerability in Wing FTP Server to gain control of affected systems.
The vulnerability identified as CVE-2025-47812 can allow remote code execution at the root level due to a null byte and Lua injection issue, according to Huntress researchers.
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Huntress researchers noticed a customer being exploited on July 1, just one day after the previous vulnerability research was published.
Attackers can exploit the vulnerability by crafting a specific input in Lua, the programming language used for handling sessions in Wing FTP.
Wing FTP has about 10,000 customers, including major companies. They informed Cybersecurity Dive that they’ve emailed customers with instructions to fix the vulnerability through an upgrade.
Shadowserver Foundation researchers noted that exploitation of a vulnerability has been occurring since July 1. They estimate about 2,000 computers use Wing FTP and are currently identifying how many may be vulnerable.
The U.S., China and Germany have the most potential exposures, according to Shadowserver.
RCE Security said it discovered the problem while performing a test for one of its customers.
The company warned that the flaw could enable root-level access, allowing attackers to gain significant control.
“Ultimately, this means that an unauthenticated attacker can escalate their privileges to the highest possible ones, which usually always means a total server compromise, including all secrets such as passwords,” said Julien Ahrens, a penetration tester at RCE security. “They can read, modify and delete any file.”
This could not only enable data to be quietly exfiltrated, but systems are also potentially vulnerable to ransomware.
