#crushftp — Public Fediverse posts

CrushFTP Servers Hit by Critical Zero-Day Vulnerability CVE-2025-54309 https://thecyberexpress.com/crushftp-zero-day-flaw-cve-2025-54309/ #CrushFTPfiletransfer #zerodayvulnerability #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202554309 #CyberNews #CrushFTP

CISA Warns of CrushFTP Exploit Letting Attackers Bypass Authentication https://thecyberexpress.com/cisa-adds-cve-2025-31161-to-kev-catalog/ #authenticationbypass #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #CVE202531161 #CyberNews #CrushFTP

Attackers are targeting CrushFTP vulnerability with public PoC (CVE-2025-2825) https://www.helpnetsecurity.com/2025/04/01/crushftp-vulnerability-exploitation-cve-2025-2825/ #Shadowserver #Don'tmiss #VulnCheck #Hotstuff #CrushFTP #Rapid7 #News #CVE #PoC

malicious npm packages (again) targeting cryptocurrency projects, CEOs cranky over CVEs, and BlackLock gets pantsed - here's your Friday wrap up in Infosec News 👇

🔗 https://opalsec.io/daily-news-update-friday-march-28-2025-australia-melbourne/

Here's a quick rundown of what's inside:

📦 npm Package Nightmare: 10 packages compromised by an infostealer campaign targeting developer environments. Sensitive data was siphoned off to a remote host. Most of the packages are still available on npm, so be careful!
🦊 Firefox Flaw: A critical sandbox escape vulnerability (CVE-2025-2857) patched in Firefox 136.0.4. Windows users, update ASAP! This one's similar to a Chrome zero-day used in espionage campaigns.
🏥 Ransomware Reckoning: Advanced, a UK healthcare IT provider, slapped with a £3.1 million fine after a LockBit ransomware attack. Lack of vulnerability scanning and poor patch management were key factors.
🌐 Extension Exploitation: Browser extensions can be bought and repurposed, posing a sneaky threat to enterprises. An extension was bought for $50 and was quickly repurposed to redirect traffic.
⚡ Solar Scare: Dozens of vulnerabilities in solar inverters could let attackers disrupt power grids. Remote code execution, device takeover, and more are possible.
😠 CrushFTP Clash: CEO responds aggressively to VulnCheck after critical unauthenticated access vulnerability (CVE-2025-2825) is released. Vulnerability disclosure and patching processes need to be improved!
🕵️‍♀️ Pegasus in Serbia: Journalists targeted with Pegasus spyware, marking the third time in two years that Amnesty has found Pegasus deployed against Serbian civil society.
🤖 Mamont Malware: Russian authorities arrest three for developing the Mamont Android banking trojan. This malware steals financial data and spreads through Telegram.
🦹 Ransomware Reverse: Resecurity infiltrates the BlackLock ransomware gang, gathering intel to help victims. LFI vulnerability exploited, and data shared with authorities.

Stay vigilant out there, folks! 🛡️

#Cybersecurity #InfoSec #Vulnerability #Ransomware #Malware #npm #Firefox #Pegasus #SolarInverters #DataBreach #ThreatIntel #CyberThreats #SecurityNews #WebAppSec #ZeroDay #PatchManagement #infostealer #blacklock #crushftp #mamont

5000+ CrushFTP Servers Hacked Using Zero-Day Exploit https://gbhackers.com/crushftp-servers-zero-day-hack/ #CVE/vulnerability #CyberSecurityNews #ZerodayExploit #cybersecurity #CyberAttack #CrushFTP #ZeroDay

@campuscodi Kudos to @h4sh for assigning the CVE to the actively exploited CrushFTP zero-day: https://infosec.exchange/@h4sh/112316550866303546

According to his analysis and patch diffing, the CVSSv3 score for CVE-2024-4040 is 7.7 HIGH: Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Did some patch diffing on the new #crushFTP bug, and it does look like the bug has 2 components and at least one of them need some form of authentication to exploit (need creation of something).
After the first stage, the reading of the file outside of VFS sandbox might not need authentication. I am not sure.

#CrushFTP #zeroday #vulnerability #CVE_2024_4040 #eitw #activeexploitation

Shoutout to @h4sh for getting a CVE ID assigned to this actively exploited zero-day CrushFTP vulnerability: CVE-2024-4040 (reported by Simon Garrelou, of Airbus CERT). https://www.cve.org/CVERecord?id=CVE-2024-4040

VFS Sandbox Escape in CrushFTP in all versions before 10.7.1 and 11.1.0 on all platforms allows remote attackers with low privileges to read files from the filesystem outside of VFS Sandbox.

#zeroday #eitw #activeexploitation #CrushFTP #vulnerability #CVE_2024_4040

CrushFTP has released software updates to address a zero-day vulnerability that is being actively exploited.

The vulnerability does not yet have a CVE ID. When exploited, can allow an attacker to download sensitive files from the system.

Administrators are advised to patch ASAP.

#cybersecurity #CrushFTP #zeroday #activeexploitation

https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/

It's not a Friday without an actively exploited zero-day vulnerability (with no CVE ID) in a file transfer product. cc: @todb

• Bleeping Computer: CrushFTP warns users to patch exploited zero-day “immediately”
• CrushFTP: CrushFTP: Update
• Exploitation report: CrowdStrike on Reddit: SITUATIONAL AWARENESS // 2024-04-19 // CrushFTP Virtual Filesystem Escape Vulnerability in the Wild

#zeroday #eitw #activeexploitation #CrushFTP #vulnerability