At a glance.
- CISA confirms exploitation of maximum-severity Wing FTP flaw.
- Google patches actively exploited Chrome flaw.
- Europol disrupts Romanian ransomware gang.
CISA confirms exploitation of maximum-severity Wing FTP flaw.
CISA has added a critical vulnerability (CVE-2025-47812) affecting Wing FTP Server to its Known Exploited Vulnerabilities (KEV) Catalog, ordering Federal civilian agencies to patch the flaw by August 4th. The vulnerability, which was assigned a CVSS score of 10, can allow attackers to inject arbitrary Lua code into user session files with the privileges of the FTP service, which are root or SYSTEM by default. The vulnerability's CVE record describes it as "a remote code execution vulnerability that guarantees a total server compromise."
Researchers at Huntress observed exploitation against a customer on July 1st, one day after an initial write-up was published.
Google patches actively exploited Chrome flaw.
Google has fixed a high-severity Chrome vulnerability (CVE-2025-6558) that's being exploited in the wild, BleepingComputer reports. The vulnerability results from "insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157," and can allow an attacker to perform a sandbox escape via a crafted HTML page. Google is not disclosing details of the flaw until a majority of users have applied the fix.
Europol disrupts Romanian ransomware gang.
A law enforcement operation coordinated by Europol has disrupted a Romanian ransomware gang known as "Diskstation," BleepingComputer reports. The gang has been targeting Synology Network-Attached Storage (NAS) devices since at least 2021. The Italian State Police, collaborating with law enforcement in France and Romania, traced ransom payments and identified several suspects in Bucharest. The alleged ringleader of the group, a 44-year-old Romanian citizen, is in detention as he awaits trial. This individual is accused of leading ransomware attacks against numerous Italian organizations.
