Disclosure Drama Clouds CrushFTP Vulnerability Exploitation

A critical authentication-bypass vulnerability in CrushFTP was disclosed and quickly weaponized after conflicting CVE assignments and public analyses published proof-of-concept exploits; Shadowserver detected 1,512 vulnerable instances and vendors reported customer compromises. The report details the disclosure timeline, disputes between CrushFTP, VulnCheck, Outpost24 and others, technical write-ups from ProjectDiscovery and Rapid7 that included PoCs, and mitigation guidance (update to CrushFTP 11.3.1 or enable DMZ) while noting ongoing exploitation.