Flax Typhoon puts five more flaws on CISA’s urgent patch list

Feeds.4Sysops •IT News • October 9, 2026

CISA has added five actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, giving U.S. federal agencies until October 11, 2026, to patch them or stop using the affected products. The warning coincides with a U.S. law-enforcement disruption of tools linked to Integrity Technology Group, which enabled activity associated with Flax Typhoon. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include CVE-2015-3306 (CVSS 10.0), CVE-2021-3199 (CVSS 9.8), CVE-2023-22894 (CVSS 7.2), CVE-2016-3081 (CVSS 8.1), and CVE-2015-5477 (CVSS 7.5). These flaws affect widely used software, including ProFTPD, ONLYOFFICE Docs, and Apache Struts, allowing attackers to execute arbitrary code, read sensitive files, and cause denial-of-service attacks. The vulnerabilities have been actively exploited to breach networks and steal sensitive data. CISA's directive requires agencies to either apply vendor patches or discontinue the use of the affected software. A joint advisory from several countries, including the U.S. and the U.K., implicated Integrity Technology Group, a Beijing-based cybersecurity firm, in facilitating these attacks. 6 sources 81

Extracted Entities

APT Groups (1)

Flax Typhoon