[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fsJQMI2p5x2OmW60e5g6LlyJdYy7Tt7cDFtDW7VNRZyA":3},{"article":4,"iocs":55,"watch_terms":81,"solutions":82,"lesson":170},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"2ff2660a-5fd0-4c7b-bed6-da98bcc248c2","Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies","flax-typhoon-exploits-five-flaws-as-cisa-sets-october-11-deadline-for-federal-ag-d96e6f","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to their active exploitation by the China-linked threat actor Flax Typhoon. These vulnerabilities, including critical flaws in ProFTPD and ONLYOFFICE Docs, are being used for initial access and data exfiltration. Federal agencies are mandated to patch these vulnerabilities or discontinue the use of affected software by October 11, 2026.","CISA adds five vulnerabilities exploited by Flax Typhoon to KEV catalog, mandating federal agency action.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fflax-typhoon-exploits-five-flaws-as.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEj7eHv-Bv5ZZISuomW-aV50jkJ7Aqg-S56iEuV2y8Kl9w7SB4cp-zTDj8WicvMzPcw5tXuq-o5rIG0KPPmKxPZPcR5V47hVwbGvi7aLNE_1wgq_iDkNERTzz5kc9ivagiHEKM9BcsYjJRRB0_HWk_gsi9jzHudV_-4Ax4dUFaV5vpDlUnW2PywmEZHzN8mm\u002Fs1600\u002Fkevs.jpg","2026-10-09T12:21:51+00:00","2026-10-09T14:00:55.08508+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Flax Typhoon","threat_actor",{"name":21,"type":22},"CISA","vendor",{"name":24,"type":25},"ProFTPD","product",{"name":27,"type":25},"ONLYOFFICE Docs",{"name":29,"type":25},"Strapi",{"name":31,"type":25},"Apache Struts","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,72,75,78],{"type":57,"value":58,"context":59},"cve","CVE-2015-3306","ProFTPD improper access control vulnerability",{"type":57,"value":61,"context":62},"CVE-2021-3199","ONLYOFFICE Docs path traversal vulnerability",{"type":57,"value":64,"context":65},"CVE-2023-22894","Strapi cleartext storage of sensitive information vulnerability",{"type":57,"value":67,"context":68},"CVE-2016-3081","Apache Struts command injection vulnerability",{"type":57,"value":70,"context":71},"CVE-2015-5477","ISC BIND reachable assertion vulnerability",{"type":57,"value":73,"context":74},"CVE-2014-6278","GNU Bash operating system command injection vulnerability (Shellshock)",{"type":57,"value":76,"context":77},"CVE-2019-11510","Ivanti Pulse Connect Secure arbitrary file read vulnerability",{"type":57,"value":79,"context":80},"CVE-2021-22205","GitLab Community and Enterprise Edition remote code execution vulnerability",[21,24,27],{"controls":83,"vendors":166},[84,113,141],{"slug":85,"name":86,"problem":87,"products":88},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":114,"name":115,"problem":116,"products":117},"patch-management","Automated patch management","Known holes get closed in days, not months.",[118,126,133],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":114,"product_name":130,"url":131,"description":132},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":54,"name":142,"problem":143,"products":144},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[145,153,158],{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":154,"product_name":155,"url":156,"description":157},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":159,"vendor_name":160,"vendor_logo":161,"product_slug":162,"product_name":163,"url":164,"description":165},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[167],{"slug":134,"name":135,"logo_path":136,"roles":168},[169],"affected",{"slug":171,"title":172,"body":173,"framework_refs":174,"framework_notes":185},"flax-typhoon-actively-exploits-five-known-vulnerabilities-cisa-issues-october-deadline","Flax Typhoon Actively Exploits Five Known Vulnerabilities — CISA Issues October Deadline","The China-linked threat actor Flax Typhoon is actively exploiting five known vulnerabilities, including critical flaws in ProFTPD and ONLYOFFICE Docs, to gain initial access and exfiltrate data from targeted systems. These vulnerabilities were already documented and catalogued, meaning organizations had the opportunity to patch before exploitation occurred — a classic failure of timely patch management. CISA's mandate for federal agencies underscores that known, unpatched vulnerabilities remain one of the most preventable yet persistent attack vectors. The fact that nation-state actors are leveraging these flaws highlights the real-world consequences of delayed remediation, particularly for critical infrastructure and government systems.",[175,176,177,178,179,180,181,182,183,184],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection","CISA BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities","ITIL Problem Management: Root Cause Analysis and Known Error Remediation","NIST CSF: Respond (RS.MI-3) and Protect (PR.IP-12)",{}]