Loading story…
A critical flaw in the open-source file-sharing platform ProjectSend is being actively exploited in the wild, allowing unauthenticated attackers to take over vulnerable servers. The vulnerability, tracked as CVE-2024-11680, affects versions earlier than r1720 and stems from crafted HTTP requests to options.php that let attackers alter application configuration without logging in. Researchers reported exploitation dating back to at least September 2024, while the bug itself had been patched earlier, leaving many internet-exposed instances still vulnerable.
Successful exploitation can enable attackers to create user accounts, enable new-user registration, upload webshells, inject malicious JavaScript, and ultimately achieve remote code execution with full control of the system. Defenders were urged to upgrade immediately to ProjectSend r1720 or later and investigate for signs of compromise, including suspicious PHP files under /upload/files/, unexpected changes to homepage text, and unauthorized account or registration-setting changes.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
VulnCheck reported that exploitation of the ProjectSend vulnerability had been observed in the wild since at least September 2024. The bug could be abused to create accounts, upload webshells, inject JavaScript, and execute code remotely.
The ProjectSend vulnerability received the identifier CVE-2024-11680 in November 2024. This occurred well after the patch had already been released.
ProjectSend fixed the vulnerability affecting versions earlier than r1720 in May 2023. The flaw allowed unauthenticated attackers to change configuration and ultimately gain full control of affected systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting a critical ShowDoc vulnerability, **CVE-2025-0520** (also referenced as **CNVD-2020-26585**), to compromise unpatched servers exposed to the internet. The flaw affects ShowDoc versions before **2.8.7** and stems from an unauthenticated unrestricted file upload weakness that lets attackers upload arbitrary PHP files, plant web shells, and achieve remote code execution; it carries a **CVSS score of 9.4**. Researchers reported observed exploitation against a vulnerable U.S.-based honeypot, where attackers dropped a web shell after targeting the application. More than **2,000** internet-exposed ShowDoc instances were identified online, most of them in China, underscoring the continued risk from older **N-day** vulnerabilities that remain unpatched years after a fix was released in ShowDoc **2.8.7**; the current version is **3.8.1**, and users are being urged to upgrade and lock down exposed systems.
Jun 29, 2026
Researchers disclosed a **pre-authenticated remote code execution** chain affecting **Progress ShareFile Storage Zone Controller 5.x**. The chain combines **CVE-2026-2699**, an authentication bypass in `/ConfigService/Admin.aspx` caused by execution continuing after an HTTP redirect, with **CVE-2026-2701`, which allows code execution by changing the storage location to a webroot path and abusing ZIP upload-and-extract behavior to write a malicious **ASPX webshell** to disk. The attack can give unauthenticated attackers access to the ShareFile admin interface, enable changes to storage zone configuration and secrets, and potentially support file exfiltration from affected environments. The issues were reported by watchTowr and fixed by Progress in **ShareFile Storage Zone Controller 5.12.4**. The research focused on the **5.x** branch, including version **5.12.3**, and highlighted substantial internet exposure: watchTowr said roughly **30,000** Storage Zone Controller instances were discoverable online, while Shadowserver observed about **700** internet-exposed Progress ShareFile systems, primarily in the United States and Europe. No active exploitation was reported at disclosure, but the publication of the exploit chain raises the risk of follow-on attacks against unpatched on-premises deployments.
Jun 29, 2026
A critical SmarterTools *SmarterMail* vulnerability, **CVE-2025-52691**, enables **remote code execution (RCE)** via an **unauthenticated arbitrary file upload** condition (CWE-434). The issue affects SmarterMail **Build 9406 and earlier** and is fixed in **Build 9413 and later**; the NVD lists a **CVSS v3.1 score of 10.0** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`). Successful exploitation can allow full server compromise, including webshell deployment, data theft, and lateral movement under the service’s privileges. Internet-wide scanning reported **8,001 likely vulnerable IPs** out of **18,783** exposed SmarterMail instances (about **42.6%** failing checks), with the largest concentration in the **United States (~5,000)** followed by the **UK** and **Malaysia**. **Public proof-of-concept exploit code** is available, increasing the likelihood of opportunistic exploitation against unpatched, internet-facing deployments; multiple national agencies reportedly issued advisories following disclosure in late December 2025.
Jun 29, 2026