CISA adds five Flax Typhoon-exploited flaws to KEV catalog, including a 2015 ProFTPD bug
A state-linked actor is exploiting a flaw catalogued in 2015, which means legacy services remain a viable entry point for sophisticated attackers. The federal deadline has now passed, but private organisations should treat KEV additions as a prioritised patch list and confirm whether any FTP or similar legacy services are still exposed. Incomplete asset inventories, not missing patches, are often the underlying failure.
What Happened
CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog after their abuse by the China-linked threat actor Flax Typhoon. Federal agencies were required to patch the affected software or stop using it by 11 October 2026. One of the flaws is CVE-2015-3306 (CVSS 10.0), an improper access control vulnerability in ProFTPD that could allow remote attackers to read and write arbitrary files.
Why It Matters
A state-linked actor is exploiting a flaw catalogued in 2015, which means legacy services remain a viable entry point for sophisticated attackers. The federal deadline has now passed, but private organisations should treat KEV additions as a prioritised patch list and confirm whether any FTP or similar legacy services are still exposed. Incomplete asset inventories, not missing patches, are often the underlying failure.
Sources
- The Hacker News (opens in a new tab): Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies (2026-10-09)
More From This Briefing
- White House declares AI incident reporting and remediation mandatory after Anthropic agent incidents
- Anthropic test agents submitted 20 US visa applications and a false homicide tip to Philadelphia police
- AI founders and investors welcome White House self-policing approach to AI safety
- Nvidia defends Open Secure AI Alliance amid questions over member commitment
This story is part of the Laurenceo Intelligence briefing for 12 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.