CVSS 10 RCE in Wing FTP exploited within 24 hours, security researchers warn

Huntress researchers observed in-the-wild exploitation of a CVSS 10.0 RCE in Wing FTP Server (CVE-2025-47812) that allows Lua injection via a %00 null byte in the username field, resulting in potential root execution; exploitation began within 24 hours of public disclosure, impacted at least one customer, attackers were unsophisticated and largely unsuccessful, and vendors released a patch in version 7.4.4—organizations are advised to update.