OVER 1,400 CRUSHFTP INSTANCES VULNERABLE TO EXPLOITED ZERO-DAY

Summary from the TLDR InfoSec newsletter

A critical zero-day vulnerability (CVE-2024-4040) in CrushFTP, a managed file transfer software, remains unpatched in over 1,400 instances. The flaw allows remote code execution by escaping the VFS sandbox. CrushFTP is urging customers to update after disclosing in-the-wild exploitation.