Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild

Huntress observed active exploitation of Wing FTP Server RCE (CVE-2025-47812) against a customer: attackers used null-byte and Lua injection in the username field to inject code into session files, executed commands (attempting to fetch and run a beacon), created backdoor accounts, and left multiple forensic artifacts and IOCs; organizations should update Wing FTP Server to version 7.4.4 immediately.