A critical zero-day flaw in the CrushFTP managed file-transfer platform was confirmed after vendor and threat-intelligence sources confirmed active exploitation beginning on 18 July 2025 at 09:00 CST. Tracked as CVE-2025-54309, the bug allows unauthenticated attackers to obtain full administrative control of vulnerable servers over HTTPS. CrushFTP says the issue was inadvertently resolved in builds […]...
Threat actors downgrade FIDO2 MFA auth in PoisonSeed phishing attack
BleepingComputer
8 hours ago
Threat actors downgrade FIDO2 MFA auth in PoisonSeed phishing attack Lawrence Abrams July 19, 2025 01:41 PM 0 A PoisonSeed phishing campaign is bypassing FIDO2 security key protections by abusing the ...
