Critical

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

The Hacker News

October 9, 2026 at 12:21 PM

Actively Exploited

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five vulnerabilities to its Known Exploited Vulnerabilities catalog, which are being actively exploited by a China-linked group known as Flax Typhoon. One of the most critical vulnerabilities is CVE-2015-3306, which has a maximum severity score of 10.0 and involves improper access control in ProFTPD, a popular FTP server software. This exploitation poses a significant risk to federal agencies and other organizations using affected systems, as attackers can potentially gain unauthorized access. CISA has set an October 11 deadline for these agencies to address the vulnerabilities to mitigate the risk of exploitation. Organizations should prioritize applying patches and updates to secure their systems against these threats.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: ProFTPD (specifically affected versions with CVE-2015-3306), federal agency systems using vulnerable software.
Action Required: Federal agencies must apply patches and updates to ProFTPD to address CVE-2015-3306 and other listed vulnerabilities by October 11, 2023.
Timeline: Disclosed on October 5, 2023

Original Article Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow

Impact

ProFTPD (specifically affected versions with CVE-2015-3306), federal agency systems using vulnerable software.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on October 5, 2023

Remediation

Federal agencies must apply patches and updates to ProFTPD to address CVE-2015-3306 and other listed vulnerabilities by October 11, 2023.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Critical.

Read Original Article

Related Coverage

P7 DarkSword iOS Exploit Kit Adds Crypto Wallet Data Theft and Remote Commands

The Hacker News

A new variant of the DarkSword iOS exploit kit, named P7 DarkSword, has been discovered by cybersecurity researchers. This variant is notable for its reduced footprint on devices and its ability to steal data from on-device keychains and cryptocurrency wallets. Additionally, it enables two-way communication with the attacker's servers, which raises significant security concerns. Users of iOS devices, especially those with crypto wallets, are particularly at risk, as their sensitive information could be compromised. The emergence of this exploit kit underscores the ongoing challenges in mobile security and the need for users to remain vigilant about their data protection practices.

Oct 9, 2026

TP-Link Sued by Four More U.S. States Over Router Security and China Ties

The Hacker News

On October 6, four U.S. states—Florida, Iowa, Montana, and Nebraska—joined Texas in suing TP-Link Systems over allegations that the company misled consumers regarding the security of its routers and its ties to China. The states claim that TP-Link has not been transparent about the vulnerabilities associated with its products, potentially putting users at risk. TP-Link, which is based in California, has denied these allegations and intends to contest the lawsuits in court. This situation raises concerns about the security of consumer networking devices and the trust users place in manufacturers regarding data protection and privacy. As the legal battle unfolds, it may influence how companies disclose information about their products and their security measures.

Oct 9, 2026

Researchers Publish Working Exploit for Pre-Auth AnyDesk Linux Flaw That Gives Root Access

The Hacker News

Researchers have released a working exploit for a serious flaw in AnyDesk's Linux software that allows attackers to execute code remotely and gain root access without any user authentication. This vulnerability was patched in version 8.0.3 in June 2023, but the company described the fix vaguely as a bug that could cause crashes, failing to assign a CVE identifier. Users of AnyDesk on Linux systems are at risk, as the exploit can be executed before a connection is approved. This situation raises concerns about the transparency of security updates and the potential for malicious exploitation if users do not update their software promptly.

Oct 9, 2026

Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

The Hacker News

Attackers are exploiting two recently disclosed vulnerabilities in the AhsayCBS backup utility, which is used for data backup and recovery. These flaws allow the attackers to take control of affected devices and deploy malicious software, including web shells and XMRig cryptocurrency miners disguised as Microsoft Edge. The specific vulnerability, identified as CVE-2026-105133, has a CVSS v4 score of 5.5, indicating a moderate level of risk. This situation primarily affects users of the AhsayCBS backup software, which could lead to unauthorized access and potential financial losses due to the mining activities. Companies using this utility should be vigilant and assess their systems for these vulnerabilities to prevent exploitation.

Oct 9, 2026

The AI Velocity Paradox: Why Security Is Decades Behind AI Ambition

The Hacker News

A recent report from SailPoint examines the growing gap between the rapid deployment of AI technologies in businesses and the outdated security measures still in place. This 'velocity paradox' indicates that while companies are racing to adopt autonomous AI agents to improve efficiency, their security systems remain anchored in older, slower protocols designed for human operators. This mismatch creates vulnerabilities as organizations may not be able to effectively manage the risks associated with fast-moving AI operations. The report suggests that companies need to rethink their security strategies to keep pace with technological advancements, or they risk compromising their data and operations. The findings are especially relevant for businesses integrating AI into their workflows, as they may unwittingly expose themselves to significant security risks.

Oct 9, 2026

GoBalance Flaw Lets Attackers Hijack .onion Addresses by Recovering Tor-Format Keys

The Hacker News

A recently discovered flaw in GoBalance, a tool used by various dark-web sites, poses a significant risk to users of .onion addresses. Researchers at Searchlight Cyber reported on October 8 that attackers can exploit this vulnerability to recover the secret key controlling a site's .onion address using only publicly available information. Once they obtain this key, they can redirect visitors to a fake version of the site, which could lead to data theft or other malicious activities. This incident is particularly concerning for users who rely on these sites for privacy and security, as it undermines the very foundation of anonymity that the Tor network is designed to provide. The potential for abuse emphasizes the need for improved security measures in tools like GoBalance.

Oct 9, 2026