InfoSecBulletin Cybersecurity for mankind
Security researchers warn that hackers are exploiting a critical vulnerability in Wing FTP Server to gain control of affected systems.
The vulnerability identified as CVE-2025-47812 can allow remote code execution at the root level due to a null byte and Lua injection issue, according to Huntress researchers.
Microsoft’s November 2026 Patch Tuesday addresses 1,093 flaws, with Outlook zero-day
Barracuda ESG flaws exploited, gaining root access
Apple, SAP, and Ivanti Patch Critical flaws Affecting Messaging, Bluetooth, and Enterprise Systems
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Huntress researchers noticed a customer being exploited on July 1, just one day after the previous vulnerability research was published.
Attackers can exploit the vulnerability by crafting a specific input in Lua, the programming language used for handling sessions in Wing FTP.
Wing FTP has about 10,000 customers, including major companies. They informed Cybersecurity Dive that they’ve emailed customers with instructions to fix the vulnerability through an upgrade.
Shadowserver Foundation researchers noted that exploitation of a vulnerability has been occurring since July 1. They estimate about 2,000 computers use Wing FTP and are currently identifying how many may be vulnerable.
The U.S., China and Germany have the most potential exposures, according to Shadowserver.
RCE Security said it discovered the problem while performing a test for one of its customers.
The company warned that the flaw could enable root-level access, allowing attackers to gain significant control.
“Ultimately, this means that an unauthenticated attacker can escalate their privileges to the highest possible ones, which usually always means a total server compromise, including all secrets such as passwords,” said Julien Ahrens, a penetration tester at RCE security. “They can read, modify and delete any file.”
This could not only enable data to be quietly exfiltrated, but systems are also potentially vulnerable to ransomware.
