Hackers have started to exploit a critical remote code execution vulnerability in Wing FTP Server just one day after technical details on the flaw became public.

The observed attack ran multiple enumeration and reconnaissance commands followed by establishing persistence by creating new users.

The exploited Wing FTP Server vulnerability is tracked as CVE-2025-47812 and received the highest severity score. It is a combination of a null byte and Lua code injection that allows remote a unauthenticated attacker to execute code with the highest privileges on the system (root/SYSTEM).

Wing FTP Server is a powerful solution for managing secure file transfers that can execute Lua scripts, which is widely used in enterprise and SMB environments.

On June 30, security researcher Julien Ahrens published a technical write-up for CVE-2025-47812, explaining that the flaw stems from unsafe handling of null-terminated strings in C++ and improper input sanitization in Lua.

The researcher demonstrated how a null byte in the username field could bypass authentication checks and enable Lua code injection into session files.

When those files are subsequently executed by the server, it is possible to achieve arbitrary code execution as root/SYSTEM.

Along with CVE-2025-47812, the researcher presented another three flaws in Wing FTP:

• CVE-2025-27889 – allows exfiltrating user passwords via a crafted URL if the user submits a login form, due to unsafe inclusion of the password in a JavaScript variable (location)
• CVE-2025-47811 – Wing FTP runs as root/SYSTEM by default, with no sandboxing or privilege drop, making RCEs far more dangerous
• CVE-2025-47813 – supplying an overlong UID cookie reveals file system paths

All the flaws impact Wing FTP versions 7.4.3 and earlier. The vendor fixed the issues by releasing version 7.4.4 on May 14, 2025, except for CVE-2025-47811, which was deemed unimportant.

Threat researchers at managed cybersecurity platform Huntress created a proof-of-concept exploit for CVE-2025-47812 and show in the video below how hackers could leverage it in attacks:

Huntress researchers found that on July 1st, a day after technical details for CVE-2025-47812 appeared, at least one attacker exploited the vulnerability at one of their customers.

The attacker sent malformed login requests with null-byte-injected usernames, targeting ‘loginok.html.’ These inputs created malicious session .lua files that injected Lua code into the server.

The injected code was designed to hex-decode a payload and execute it via cmd.exe, using certutil to download malware from a remote location and execute it.

Huntress says that the same Wing FTP instance was targeted by five distinct IP addresses within a short time frame, potentially indicating mass-scanning and exploitation attempts by several threat actors.

The commands observed in these attempts were for reconnaissance, obtaining persistence in the environment, and data exfiltration using the cURL tool and webhook endpoint.

The hacker failed the attack “maybe due to their unfamiliarity with them, or because Microsoft Defender stopped part of their attack,” Huntress says. Nevertheless, the researchers observed clear exploitation of the critical Wing FTP Server vulnerability.

Even if Huntress observed failed attacks at their customers, hackers are likely to scan for reachable Wing FTP instances and try to take advantage of vulnerable servers.

Companies are strongly advised to upgrade to version 7.4.4 of the product as soon as possible.

If switching to a newer, secure version is not possible, the researchers’ recommendation is to disable or restrict HTTP/HTTPs access to the Wing FTP web portal, disable anonymous logins, and monitor the session directory for suspicious additions.

Start the engine and start your favorite memokine! Kraken has you in the driver’s seat of the legendary Crypto competition!

In July this year, Meme Coin will be wheel-to-wheel with high octane, holdbar red Trading race where There is only one token Cross the finish line… straight Atlassian Williams Racing FW47 car rear wing Singapore Grand Prix. This is more than making memes. This is to make Memocoin history.

What is the contract?

from July 8th – August 8th, 2025Tracking the trading volume of The most painful, Dunkest, most meme coins With the Kraken app. Who has the best US dollar trading volume on the Kraken app and MemeCoin won a literal spot on the F1 grid In Rear wing of Williams Racing Carscreams at Singapore’s night race, like a penger running on rocket fuel, next to the Kraken logo.

running running memes

We have manually selected some of the most community-equipped tokens in the crypto-sphere. Here are our Rear Wing Glory competitors: Click on the token name or image to go directly to the trading screen in the Kraken app.

It’s a memocoin brawl. Blockchain Battle Royale. A token slowdown that is suitable for the main stage.

How can I participate?

easy. Simply trade your favorite Memecoin in the Kraken app. that’s it. No sign up, forms, no KYC hurdles (beyond standard ones). The coin with the most trading volume wins. You won’t win a prize directly, but if your coins take the crown, the right to brag is valuable.

Some important notes:

• c is required Crack Account.
• Open globally except for chere UK, Singapore, Austria, Türkiye, New Zealandyet other restricted jurisdictions.
• Trade only on Crack app count. Tracking the volume USD.
• There’s no bots, wash trading or shady business. When it comes to smelling the operation, we are dogs.

What is the award?

There is only one award, and it’s a big award. Get the token logo Scatters across the Atlassian Williams Racing FW47 car rear wing Between Singapore Grand Prix. It’s a major real estate. Think exposure, screenshots, fame!

Here, individuals win or are products, and there is nothing so trivial. This is about something very big: Glory of the Memecoin community.

Timeline

start: July 8, 2025 12:00am UTC
Finish: August 8, 2025 11:59pm UTC
The winner reveals: Early August, via Kraken Socials & Blog

So are you ready to send your favorite Memecoin to the grid?

Start a trade, spread the memes and see who’s registering it on the podium. Because in July, one coin will take the wings. One wing to rule them all!

Get started with Memecoin Aheaddown! If you already have the Kraken app, click on the assets you want to trade: $toshi, $pengu, $dog, $bonk, $lofi or $ponke. Do you have the Kraken app?

April 14th Bitfinex alpha | Buyers waiting on the wing

Bitcoin has recovered strongly over the past week, regaining its $85,000 level. The bounce was driven by macro bailouts after US President Donald Trump announced a 90-day suspension on new tariffs, easing trade tensions and rekindling risk appetite. Importantly, rebounding promotes demand in the spot market rather than positioning leveraged derivatives, indicating a true conviction among buyers. Bitcoin closed 6.67%, extending travel from low to 15%, suggesting a matching correction (currently 83 days, 31% depth) with typical mid-cycle retraces seen in past bull markets.

Spot cumulative volume delta across major exchanges indicates that aggressive purchases are persisting, but prices remain locked in the $75,000 to $85,000 range. This divergence indicates the possibility of an upside breakout if more supply is provided. However, short-term pullbacks are expected earlier this week, and will be driven by profit-making. The response to this dip determines whether Bitcoin will push to $90,000, whether the buyer will continue to absorb the supply or not. On-chain data adds confluence, and for the first time since December, long-term holder accumulation will be positive. Although early signals are constructive, confirmation of trend strength remains dependent on how demand continues during short-term weaknesses.

In March, headline inflation provided what appeared to be a short grace as consumer price indexes were slightly immersed due to lower energy and transportation costs. But beneath this temporary calm is an impending storm. New trade tariffs, particularly those recently enacted and threatened by the US administration, are poised to raise prices in the coming months. Core inflation, particularly in services and housing, remains stubbornly rising, reinforcing concerns that inflation pressures are over. This volatile inflation outlook is consistent with increasing instability in financial markets. Dramatic pivots in trade policy – escalating tariffs first, then rushing back through them – have undermined global confidence in the US economic direction and caused capital flights from US assets.

The dollar has weakened sharply, with Treasury yields surged, volatility surged, revealing an increasingly dominant market environment. Even the short-lived rally in the S&P 500 failed to calm fears as investors continue to tackle the consequences of volatile policy moves. Meanwhile, consumer sentiment has plummeted. The latest study from the University of Michigan shows a shocking surge in inflation expectations from levels not seen since the early 1980s, but a sharp decline in confidence and a shocking surge. Households are now anticipating sustained inflation and rising unemployment, regaining spending and embellishing for economic hardships. This erosion in both financial and consumer trust suggests that the US economy is at a critical crossroads. The Federal Reserve is facing a scenario where it won’t win, as fears of inflation collide with slowing growth. Control inflation and postpone any rate cuts while walking the tightrope while avoiding a full-scale recession. The convergence of tariff-driven inflation, policy-driven market volatility, and the collapse of consumer trust portrays a harsh warning. Unless clarity and stability are revived soon, the US economy could be heading towards its most difficult time since the pandemic.

Last week at Crypto News, Galaxy Digital secured SEC approval for Delaware’s Redomile and won the listing under Nasdaq’s ticker Glxy. The development highlights the legitimacy and scaling of crypto infrastructure, but elsewhere the risk of unregulated hype has become a tough focus. In Argentina, parliamentary investigations began on the failed Libra token. The Libra Token is a Solana-based mimecoin that was publicly recognized before its value exceeded 90%, sweeping billions with speculative market caps. What began as a political show of support for innovation quickly turned into a scandal, with lawmakers demanding accountability, and some demanding Mairay’s bluff each. Meanwhile, in the US, North Carolina has created a more cautious yet optimistic course by introducing the Digital Asset Freedom Act. It introduces a bill that proposes allowing hand-picked cryptocurrencies for tax payments and transactions. With such diverse developments unfolding simultaneously, from institutional adoption to political fallout, the crypto landscape continues to evolve as both a means of transformation and a mirror of the challenges associated with destruction.

]]> https://earlybirdsinvest.com/bitfinex-alpha-buyers-waiting-on-the-wing/feed/ 0 34359