InfoSecBulletin Cybersecurity for mankind
Security researchers warn that hackers are exploiting a critical vulnerability in Wing FTP Server to gain control of affected systems.
The vulnerability identified as CVE-2025-47812 can allow remote code execution at the root level due to a null byte and Lua injection issue, according to Huntress researchers.
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Huntress researchers noticed a customer being exploited on July 1, just one day after the previous vulnerability research was published.
Attackers can exploit the vulnerability by crafting a specific input in Lua, the programming language used for handling sessions in Wing FTP.
Wing FTP has about 10,000 customers, including major companies. They informed Cybersecurity Dive that they’ve emailed customers with instructions to fix the vulnerability through an upgrade.
Shadowserver Foundation researchers noted that exploitation of a vulnerability has been occurring since July 1. They estimate about 2,000 computers use Wing FTP and are currently identifying how many may be vulnerable.
The U.S., China and Germany have the most potential exposures, according to Shadowserver.
RCE Security said it discovered the problem while performing a test for one of its customers.
The company warned that the flaw could enable root-level access, allowing attackers to gain significant control.
“Ultimately, this means that an unauthenticated attacker can escalate their privileges to the highest possible ones, which usually always means a total server compromise, including all secrets such as passwords,” said Julien Ahrens, a penetration tester at RCE security. “They can read, modify and delete any file.”
This could not only enable data to be quietly exfiltrated, but systems are also potentially vulnerable to ransomware.
