UPDATE: Progress Software shared on June 15, 2023, that a third flaw had been discovered in their MOVEit Transfer managed file transfer (MFT) software solution. The newly addressed critical vulnerability is another SQL injection flaw, tracked as CVE-2023-35708, with the potential to lead to escalated privileges and unauthorized access to victim environments. Progress has released security patches for all affected software versions and restricted HTTPS traffic for MOVEit Cloud. They have also urged customers to restrict all external HTTP and HTTPS access to their own MOVEit Transfer environments until patching is finalized, suggesting that firewall rules be modified to temporarily block traffic on ports 80 and 443 until those vulnerable servers have been patched. Researchers believe that this vulnerability is not a bypass of any previous vulnerability, stating that it has its own attack path. It again reaffirms the claims made by researchers that the design of file transfer platforms is fundamentally flawed, and that patching single vulnerabilities will only defend organizations until threat actors are able to find another way to conduct the same type of exploitation. New findings for this campaign are being published weekly, and the Ankura CTIX team will continue to monitor the situation and inform our readers of new and interesting information.