CrushFTP CVE-2024-4040: Crushed Expectations

**CrushFTP CVE-2024-4040 (zero-day VFS escape) -- active exploitation observed and widespread exposure:** On April 19, 2024 CrushFTP patched a critical zero-day virtual file system escape in its WebInterface (CVE-2024-4040) that can allow unauthenticated access to system files and potential full system compromise; Censys observed ~4,899 hosts (5,704 instances) exposed on the internet and CrowdStrike reported exploitation attempts, vendor advisories contained confusing guidance, and Censys recommends immediate upgrade to patched versions (10.7.1 / 11.1.0).