CrushFTP is warning that threat actors are actively exploiting a zero-day vulnerability tracked as CVE-2025-54309, which allows attackers to gain administrative access via the web interface on vulnerable servers.

CrushFTP is an enterprise file transfer server used by organizations to securely share and manage files over FTP, SFTP, HTTP/S, and other protocols.

According to CrushFTP, threat actors were first detected exploiting the vulnerability on July 18th at 9AM CST, though it may have begun in the early hours of the previous day.

CrushFTP CEO Ben Spink told BleepingComputer that they had previously fixed a vulnerability related to AS2 in HTTP(S) that inadvertantly blocked this zero-day flaw as well.

“A prior fix by chance happened to block this vulnerability too, but the prior fix was targeting a different issue and turning off some rarely used feature by default,” Spink told BleepingComputer.

CrushFTP says it believes threat actors reverse engineered their software and discovered this new bug and had begun exploiting it on devices that are not up-to-date on their patches.

“We believe this bug was in builds prior to July 1st time period roughly…the latest versions of CrushFTP already have the issue patched,” reads CrushFTP’s advisory.

“The attack vector was HTTP(S) for how they could exploit the server. We had fixed a different issue related to AS2 in HTTP(S) not realizing that prior bug could be used like this exploit was. Hackers apparently saw our code change, and figured out a way to exploit the prior bug.

“As always we recommend regularly and frequent patching. Anyone who had kept up to date was spared from this exploit.”

The attack occurs via the software’s web interface in versions prior to CrushFTP v10.8.5 and CrushFTP v11.3.4_23. It is unclear when these versions were released, but CrushFTP says around July 1st.

CrushFTP stresses that systems that have been kept up to date are not vulnerable.

Enterprise customers using a DMZ CrushFTP instance to isolate their main server are not believed to be affected by this vulnerability.

Administrators who believe their systems were compromised are advised to restore the default user configuration from a backup dated before July 16th. Indicators of compromise include:

• Unexpected entries in MainUsers/default/user.XML, especially recent modifications or a last_logins field
• New, unrecognized admin-level usernames such as 7a0d26089ac528941bf8cb998d97f408m.

Spink says that they are most commonly seeing the default user modified as the main IOC.

“In general we have seen the default user modified as the main IOC. In general, modified in very invalid ways that were still useable for the attacker but no one else,” Spink told BleepingComputer.

CrushFTP recommends reviewing the upload and download logs for unusual activity and taking the following steps to mitigate exploitation:

• IP whitelisting for server and admin access
• Use of a DMZ instance
• Enabling automatic updates

However, cybersecurity firm Rapid7 says using a DMZ may not be a reliable strategy to prevent exploitation.

“Out of an abundance of caution, Rapid7 advises against relying on a demilitarized zone (DMZ) as a mitigation strategy,” warned Rapid7.

At this time, it is unclear if the attacks were used for data theft or to deploy malware. However, managed file transfer solutions have become high-value targets for data theft campaigns in recent years.

In the past, ransomware gangs, usually Clop, have repeatedly exploited zero-day vulnerabilities in similar platforms, including Cleo, MOVEit Transfer, GoAnywhere MFT, and Accellion FTA, to conduct mass data theft and extortion attacks.

July 15th, 2025 – Los Angeles, USA

Allnodes, a leading platform for blockchain infrastructure, is among the first in the world to offer pre-orders for hosting on new AMD Ryzen Threadripper PRO 9000 Series processors as part of its bare-metal server lineup.

The newest hardware upgrade enables Allnodes to deliver even more powerful and efficient infrastructure to its users, meeting the highest performance demands of any blockchain.

“At Allnodes, we work hard to bring our users the latest and most powerful infrastructure available,” said Konstantin Boyko-Romanovsky, Founder and CEO at Allnodes. “The launch of the 9000 Series provides a natural next step, offering significantly improved architecture efficiency, critical for handling the increasing computational standards across today’s blockchain networks.”

The new AMD Ryzen Threadripper PRO 9000 Series processors, available through Allnodes’ bare-metal hosting solutions, include the 9965WX and 9975WX models, featuring up to 32 cores, 64 threads, 5.4 GHz Max Boost, and up to 1024GB of memory.

With up to 22% higher multi-core performance compared to the previous generation of Threadripper series, it is an ideal upgrade for customers who prioritize maximum single-core performance with more than 256GB of memory.

About Allnodes

Allnodes delivers high-performance bare metal servers tailored for Web3 infrastructure, along with secure, non-custodial solutions for node hosting and staking. With over $3.1 billion in hosted node value, support for 119 blockchains, and more than 30,000 active nodes, Allnodes is trusted by individuals and institutions worldwide. The platform also provides reliable RPC endpoints for developers and teams building in the decentralized ecosystem.

https://www.allnodes.com/hosting

Contact

Support
press@allnodes.com

June 11th, 2025 – Los Angeles, USA

Allnodes, a provider of non-custodial staking and node hosting services, has introduced a new range of bare-metal servers tailored specifically for Solana validators and infrastructure developers.

Designed to meet Solana’s stringent performance requirements, these single-tenant servers offer high throughput, low latency, and enterprise-grade reliability, without requiring users to manage on-premises hardware.

Infrastructure Optimized for Solana Validator Demands

The new hosting solution is engineered to exceed Solana’s baseline validator specifications, ensuring consistent performance even during periods of network congestion.

Each server is powered by AMD’s latest-generation EPYC Turin processors, starting with the 24-core 9275F (up to 4.8 GHz Max Boost) and scaling to the 64-core 9575F (up to 5.0 GHz Max Boost). Standard configurations include 256GB of DDR5 ECC RAM running at 4800 MHz, with available upgrades up to 3072GB at 4000 MHz or 1280GB at 6400 MT/s. This flexibility supports validators leveraging Jito-Solana infrastructure and those requiring enhanced Maximal Extractable Value (MEV) handling.

Storage capabilities feature Gen 5 NVMe SSDs with up to 7.68TB capacity. Solidigm D7-P5310 drives, capable of delivering read speeds of 14,500 MB/s and 3.1 million IOPS, are included to support high I/O demands and rapid ledger access.

Network performance includes dual 25 Gbit/s ports, with upgrade options to dual 100 Gbit/s connections. All servers are hosted in Tier 3.5+ data centers in Germany, providing redundant power systems, advanced cooling, DDoS protection, and 99.99% uptime.

Validator-Centric Features

Allnodes’ offering allows validators to retain full operational control while offloading infrastructure management. Clients are provided with 24/7 access to the Intelligent Platform Management Interface (IPMI) and BIOS for remote hardware management. Customized configurations are provisioned within 24 hours, and 24/7 technical support is available for maintenance and optimization.

The service offers a fixed-cost alternative to self-hosting, combining predictable pricing with enterprise-level performance via the AMD EPYC Turin architecture.

About Allnodes

Allnodes delivers blockchain infrastructure solutions with a focus on non-custodial staking and node hosting. Supporting over 120 networks and tens of thousands of nodes, the platform manages nearly $3 billion in staked assets. Allnodes emphasizes performance, transparency, and reliability, enabling individuals and institutions to participate in decentralized networks.

Contact:

Website: www.allnodes.com/hosting

Email: support@allnodes.com

Twitter: @Allnodes

Contact

Support
support@allnodes.com