Flax Typhoon: CISA adds five 2015 to 2023 flaws to the KEV, proof that missing old patches remain the way in

> TL;DR: On October 8, 2026, CISA added five flaws to the KEV catalog after they were abused by Flax Typhoon, a China-linked actor. They date from 2015 to 2023: ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND. A joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K. and the U.S. targets operations enabled by Integrity Technology Group. Deadline for U.S. federal agencies: October 11.

The five added flaws

Three other flaws from the same campaign were already in the KEV: Shellshock (CVE-2014-6278), Ivanti Pulse Connect Secure (CVE-2019-11510) and GitLab (CVE-2021-22205). In total, eight vulnerabilities are used to gain initial access and then extract data.

How the actor operates

According to the advisory, the activity combines scanning tools to exploit the flaws, cross-site scripting and password spraying on Microsoft Exchange servers, then persistence through VPN software and exfiltration of emails and credentials with scripts. CISA's Chris Butera notes that Chinese government-affiliated actors keep positioning themselves inside critical infrastructure networks, including OT systems, to disrupt critical functions at a time of their choosing.

Why this matters for a small company

What to check now

The takeaway

Recent espionage campaigns rely less on zero-days than on forgotten patches. The useful question is not "are we exposed to the latest CVE?" but "what is still running here that nobody maintains?"