Cybersecurity
CISA adds five flaws after Flax Typhoon abuse
CISA added five flaws to its list after activity linked to Flax Typhoon, while a joint advisory from allied governments tied the attacks to Integrity Technology Group and set an October deadline.
- On Thursday, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalogue after linking them to Flax Typhoon activity.
- The issues were CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081 and CVE-2015-5477, affecting ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND.
- A joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K. and the U.S. said the attacks were enabled by Integrity Technology Group.
- CISA said federal agencies had to patch the systems or stop using them by 11 October 2026.
CISA said on Thursday that it had placed five flaws on its Known Exploited Vulnerabilities catalogue after linking them to Flax Typhoon. The vulnerabilities were in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND, and the article gave their CVE numbers as CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081 and CVE-2015-5477.
The article said the first flaw could let an attacker read or change arbitrary files, the second could lead to remote code execution, the third could expose sensitive user details, the fourth could allow arbitrary code execution and the fifth could cause a denial of service. It said the five flaws were added because they had been abused.
The same announcement coincided with a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K. and the U.S. That advisory said the attacks had been enabled by Integrity Technology Group.
The advisory said the operators had used eight vulnerabilities in total, including Shellshock, Ivanti Pulse Connect Secure and GitLab Community and Enterprise Edition. It also said they had used scanning tools, cross-site scripting, password spraying on Microsoft Exchange servers, VPN persistence and scripts to steal emails and credentials.
Chris Butera said Chinese government-affiliated actors were placing themselves inside critical infrastructure networks. CISA said federal agencies had to apply the fixes or stop using the affected systems by 11 October 2026.
Named in this story
People
- Chris Butera
- said Chinese government-affiliated actors were entering critical infrastructure networks
Companies
- Integrity Technology Group
- was named in the advisory as enabling the attacks
Organisations
- Flax Typhoon
- was the China-linked threat actor tied to the exploitation
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the five flaws to its Known Exploited Vulnerabilities catalogue
- Australia
- joined the joint advisory
- Canada
- joined the joint advisory
- Japan
- joined the joint advisory
- New Zealand
- joined the joint advisory
- Spain
- joined the joint advisory
- The U.K.
- joined the joint advisory
- The U.S.
- joined the joint advisory
Products and systems
- ProFTPD
- was one of the affected products
- ONLYOFFICE Docs
- was one of the affected products
- Strapi
- was one of the affected products
- Apache Struts
- was one of the affected products
- ISC BIND
- was one of the affected products
- GNU Bash
- was one of the three other vulnerabilities already in CISA's catalogue
- Ivanti Pulse Connect Secure
- was one of the three other vulnerabilities already in CISA's catalogue
- GitLab Community and Enterprise Edition
- was one of the three other vulnerabilities already in CISA's catalogue
- Microsoft Exchange
- was the server software targeted in password spraying
How the source tells it
The piece was mostly procedural, with urgency from the October deadline and threat framing from the quoted warning about Chinese government-affiliated actors.
- urgency the deadline for federal agencies to patch or discontinue use by 11 October 2026
- threat the official warning about Chinese government-affiliated actors moving into critical infrastructure networks