CrushFTP has alerted users to a critical zero-day vulnerability impacting versions 9, 10, and 11 of their file transfer server software, which has been actively exploited in the wild. This security flaw enables unauthenticated attackers to escape the virtual file system (VFS) and download sensitive system files, which could lead to further exploitation. The vulnerability was discovered by Simon Garrelou of Airbus CERT and has been patched in the newly released versions 10.7.1 and 11.1.0. Customers using a DMZ (demilitarized zone) to filter protocols and connections are reported to be protected against these specific attacks. However, CrushFTP emphasizes the importance of all users, particularly those with exposed web interfaces, updating their systems immediately. Cybersecurity researchers have observed the exploit being used in targeted attacks, mainly against U.S. entities, suggesting that the attacks may be politically motivated or aimed at intelligence gathering. The urgency of the situation is underscored by CrushFTP’s rapid response to patch the vulnerability and their active engagement with customers to ensure updates are applied swiftly to prevent any further security breaches. CTIX analysts urge all administrators to ensure that they are running a secure version of CrushFTP and recommend that administrators consider putting a DMZ in-between their networks and the public internet to add defense-in-depth in the case of other zero-days.