Hackers exploit ProjectSend flaw to backdoor exposed servers

Threat actors are actively exploiting a critical authentication bypass in ProjectSend (CVE-2024-11680) to alter configuration, enable registrations, and deploy webshells on compromised servers; public exploits (Metasploit, Nuclei) and scanning data indicate thousands of vulnerable instances (~4,000 public-facing) with evidence of in-the-wild deployment and persistent webshells—upgrading to r1750 is strongly recommended.