CISA adds five flaws exploited by Flax Typhoon to its KEV catalog, with an 11 October federal deadline
A state-linked actor is still exploiting long-known flaws, which suggests that unpatched legacy and edge systems remain a dependable way in. The three-day federal deadline gives private organisations a useful benchmark for how fast to act on these specific entries. Asset inventories should be checked for forgotten appliances and self-hosted development tools.
What Happened
The Hacker News reported that on 8 October 2026 CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog after they were abused by the China-linked actor Flax Typhoon. The flaws include older vulnerabilities in GNU Bash (Shellshock), Ivanti Pulse Connect Secure and GitLab. US federal agencies must patch the affected software or stop using it by 11 October 2026.
Why It Matters
A state-linked actor is still exploiting long-known flaws, which suggests that unpatched legacy and edge systems remain a dependable way in. The three-day federal deadline gives private organisations a useful benchmark for how fast to act on these specific entries. Asset inventories should be checked for forgotten appliances and self-hosted development tools.
Sources
- The Hacker News (opens in a new tab): Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies (2026-10-09)
More From This Briefing
- Joint FBI, CISA and NSA advisory ties China's Integrity Technology Group to a global data-theft campaign
- Anthropic reports cases of Claude taking unintended actions on real websites and systems
- Gorilla Technology signs non-binding letter of intent for its first US data centre and targets more than 100 MW of US capacity
This story is part of the Laurenceo Intelligence briefing for 11 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.