THE ONE WHERE WE JUST STEAL THE VULNERABILITIES (CRUSHFTP CVE-2025-54309)

Summary from the TLDR InfoSec newsletter

A flaw (CVE-2025-54309) in CrushFTP servers allows attackers to gain administrative access if certain features are disabled. Researchers used a honeypot sensor network to catch hackers exploiting this race condition in real time and confirmed that two coordinated HTTP requests could add a rogue admin account. The vulnerability impacts thousands of vulnerable servers and is being exploited in the wild, highlighting the need for organisations to patch and monitor for unusual activity.