What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
CISA’s reported October 11, 2026 deadline required Federal Civilian Executive Branch (FCEB) agencies to patch five vulnerabilities attributed to Flax Typhoon or discontinue use of the affected software. The flaws span ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND; no single patch addresses all five. Other organizations are not covered by that reported federal obligation, but should check whether they run affected software and assess possible compromise as well as patch status.
What the October 11 deadline required
Contemporaneous reporting said CISA added the five flaws to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, after their abuse by Flax Typhoon. A report by 0dayNews identified the deadline as part of Binding Operational Directive 26-04 and said it applied to FCEB agencies. The deadline is October 11, 2026—not a future date.
The reported federal action was to apply patches or discontinue use of the affected software by that date. This is a federal-agency requirement, not a general deadline imposed on every business or individual. Organizations outside FCEB should treat the KEV additions and exploitation reporting as a reason to assess their own exposure, not as a claim that the directive applies to them.
Recommended Free Tools
Which five vulnerabilities were reported?
The Hacker News and 0dayNews identified five CVEs across five products. The descriptions below reflect those reports; exact affected versions and authoritative vendor remediation instructions have not been established here.
#1 Best Overall
| CVE | Product | Reported issue |
|---|---|---|
| CVE-2015-3306 | ProFTPD | Improper access control. |
| CVE-2021-3199 | ONLYOFFICE Docs | Path traversal associated with image-upload parameters when JWT is used. |
| CVE-2023-22894 | Strapi | Cleartext storage of sensitive information; reporting describes user details exposed through an admin-panel query filter. |
| CVE-2016-3081 | Apache Struts | Command injection associated with the method: prefix when Dynamic Method Invocation is enabled. |
| CVE-2015-5477 | ISC BIND | A reachable assertion vulnerability associated with TKEY queries that can cause denial of service. |
These descriptions are not a substitute for checking whether a particular installed version is affected or which vendor fix applies. The reports reviewed do not establish a verified per-product version and patch matrix, so do not infer a safe version from this list alone.
How defenders should review exposure
- Inventory the five products. Check servers, appliances, containers, cloud workloads and externally managed systems for ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND. Record installed versions, system owners and business purpose.
- Determine whether each instance is actually exposed. Establish whether the affected component is enabled, reachable from untrusted networks, or configured with the feature named in the report. For example, the Struts description specifically associates the issue with Dynamic Method Invocation being enabled. Confirm applicability against the current CISA KEV entry and the product vendor’s advisory before deciding that an instance is or is not affected.
- Use authoritative remediation instructions. For each applicable deployment, consult CISA’s KEV record and the vendor’s security advisory for affected versions, fixes and any workarounds. The reporting summarized here does not verify exact version ranges or upgrade destinations; do not deploy a guessed version based only on a news summary.
- Document the disposition. Track which systems were updated, isolated, retired or found not affected, along with the evidence and the person responsible. FCEB agencies should follow their agency’s process for demonstrating compliance with the directive.
- Assess for signs of prior access. Because exploitation was reported, review relevant authentication, administrative and network activity for unexplained access, persistence or data movement. The campaign summary mentions VPN persistence and scripts to exfiltrate emails and credentials. If investigation finds evidence of compromise, use the organization’s incident-response process; applying a patch alone does not establish that an intruder or persistence mechanism is gone.
What the campaign reporting adds
The five KEV-listed flaws are described as part of a broader set of eight vulnerabilities associated with Flax Typhoon activity, not as a complete account of the campaign. The Hacker News summarized the activity as including scanning, cross-site scripting, password spraying against Microsoft Exchange, VPN persistence, and scripts to exfiltrate emails and credentials. That is a news report’s summary of a joint advisory; it is not an independently verified indicator set or a complete incident-response guide.
In an October 8, 2026 announcement, the U.S. Department of Justice said a court-authorized seizure targeted infrastructure and tools associated with Flax Typhoon and Integrity Technology Group. DOJ described Microscan as a reconnaissance and vulnerability-scanning tool used to identify networks for later exploitation. It described FishHub as a spear-phishing tool that could, after an initial compromise, deliver malware for remote access or to search for and send files. DOJ reported approximately 20 Taiwanese universities as confirmed FishHub victims. These are DOJ’s descriptions and reported figures, not evidence that every network potentially exposed to the five vulnerabilities was affected—or cleared.
DOJ’s FBI Cyber Division Assistant Director Brett Leatherman said: “Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure.” The seizure is relevant threat context, but it does not replace checking an organization’s own systems and logs.
Rank #3
Why severity scores alone are not enough
The Hacker News report gave CVSS scores for the five entries, but 0dayNews reported different scores for the Strapi and BIND flaws. Because those two figures conflict, this article does not repeat them as settled values. Check the authoritative CVE record or vendor advisory before using a score in a risk register.
A CVSS score is severity information, not proof of exploitation in a specific environment or a measure of local business impact. For prioritization, consider whether the deployed version is affected, whether the vulnerable component is reachable and configured in a relevant way, the system’s business importance, available vendor remediation, and whether it can be isolated or retired. A score by itself cannot answer those deployment-specific questions.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
