Patch/Configuration Management

Certain versions of the legitimate plugin contained malware for a brief time period.

BleepingComputer reports that intrusions leveraging the maximum severity Wing FTP Server remote code execution flaw, tracked as CVE-2025-47812, have commenced a day after the release of public details regarding the security defect, which security researcher Julien Ahrens noted to have resulted from improper Lua input sanitization and unsafe null-terminated string management.

Malicious actors could exploit a critical unauthorized SQL injection in GUI vulnerability in Fortinet FortiWeb Fabric Connector, tracked as CVE-2025-25257, to facilitate remote code execution and complete system compromise, Hackread reports.

CISA has likely seen exploitation across federal agencies and the private sector.

Schneider Electric's EcoStruxure IT Data Center Expert software for data center equipment has been affected by six significant security flaws, which could be exploited to facilitate information leaks and remote access in critical infrastructure, according to GBHackers News.

Global job search and resume-building platform LiveCareer had more than 5.1 million files belonging to job seekers inadvertently leaked as a result of an unsecured Microsoft Azure storage container, Cybernews reports.

Nippon Steel Solutions, the leading Japanese steelmaker's cloud and cybersecurity service-focused subsidiary, has confirmed having information from its customers, partners, and employees pilfered following a March data breach facilitated by the exploitation of a network equipment zero-day vulnerability, reports Security Affairs.