Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

CISA has added five more vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming they were abused by the Chinese state-linked group Flax Typhoon. The newly listed bugs span ProFTPD (CVE-2015-3306, CVSS 10.0), ONLYOFFICE Docs (CVE-2021-3199), Strapi (CVE-2023-22894), Apache Struts (CVE-2016-3081), and ISC BIND (CVE-2015-5477), ranging from arbitrary file access and remote code execution to sensitive-data exposure and denial-of-service. The listing lines up with a joint alert from the US, Australia, Canada, Japan, New Zealand, Spain, and the UK describing how the China-based firm Integrity Technology Group has leveraged eight flaws total—including these five plus three already-known CVEs tied to Shellshock, Ivanti Pulse Connect Secure, and GitLab—to break into networks, maintain access via VPN tools, and steal emails and credentials. Federal agencies in the US are required to remediate or retire the affected software by October 11, 2026, given confirmed active exploitation.