Threat actors are actively exploiting a recently fixed remote code execution vulnerability (CVE-2025-47812) in Wing FTP Server. The vulnerability allows attackers to inject arbitrary Lua code into user session files, potentially leading to total server compromise. Although the attack was spotted quickly and the machine isolated, the incident highlights the ongoing threat. Organizations are advised to update to version 7.4.4 to protect themselves.

The Murdoc Botnet, targeting AVTECH IP cameras and Huawei HG532 routers through vulnerabilities, including CVE-2024-7029 and CVE-2017-17215, has compromised devices mainly in Malaysia, Thailand, Mexico, and Indonesia to create a Mirai botnet variant. Over 1300 IPs have been affected, and with the discovery of over 100 servers distributing Mirai malware, the scale of the issue is significant. The botnet leverages command-line injection and GTFOBins to load, execute, and manage payloads, potentially leading to widespread disruption and unauthorized access across a multitude of IoT devices, threatening the integrity and security of impacted systems.