Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

The China-linked threat actor Flax Typhoon is actively exploiting five known vulnerabilities, including critical flaws in ProFTPD and ONLYOFFICE Docs, to gain initial access and exfiltrate data from targeted systems. These vulnerabilities were already documented and catalogued, meaning organizations had the opportunity to patch before exploitation occurred — a classic failure of timely patch management. CISA's mandate for federal agencies underscores that known, unpatched vulnerabilities remain one of the most preventable yet persistent attack vectors. The fact that nation-state actors are leveraging these flaws highlights the real-world consequences of delayed remediation, particularly for critical infrastructure and government systems.