Science & Tech · Cybersecurity · 1 hr ago
CISA flags five old software flaws as actively exploited
The US cybersecurity agency CISA has added five software vulnerabilities to its list of flaws that attackers are exploiting.
The affected products include Apache Struts, BIND, ProFTPD, OnlyOffice Docs and Strapi.
Some of the vulnerabilities date back to 2015, and others affect newer software.
CISA also warned of a campaign it attributed to Chinese actors, listing all five flaws as being used to steal sensitive information.
Depending on the software and flaw, attackers may also be able to run code, disrupt services or access files and account information.
CISA says organizations should install available updates or stop using software that cannot be secured.
US federal agencies had until October 11 to address the flaws, a deadline that had passed by the time of the report.
CISA added five old software vulnerabilities to its Known Exploited Vulnerabilities catalog.
The agency said the flaws are being targeted by attackers and listed them as exploited to spy on sensitive information in a campaign attributed to Chinese actors.
The vulnerabilities affect ProFTPD, BIND, Apache Struts, OnlyOffice Docs and Strapi.
CISA said organizations should update affected software or stop using it when no secure version is available.
The deadline for US federal agencies to address the flaws was October 11.
- Who
- The US Cybersecurity and Infrastructure Security Agency (CISA) and attackers targeting the flaws.
- What
- CISA added five software vulnerabilities to its Known Exploited Vulnerabilities catalog. It said all five were exploited to spy on sensitive information in a campaign attributed to Chinese actors.
- When
- CISA added the flaws late in the week before October 12, 2026. The federal-agency deadline was October 11.
- Where
- In software including ProFTPD, BIND, Apache Struts, OnlyOffice Docs and Strapi; specific attack locations are not stated.
- Why
- The flaws are being exploited to obtain sensitive information, according to a CISA warning.
This story does not have two clearly opposing sides.
No direct quotes in the coverage so far.
CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog.
The deadline for US federal agencies to address the flaws ended.
- Vulnerabilities added
- 5
- Affected software
- ProFTPD, BIND, Apache Struts, OnlyOffice Docs and Strapi
- Oldest flaws
- Date from 2015
- Federal-agency deadline
- October 11, 2026
- Campaign attribution
- Chinese actors
Sources
Related news
Let’s Encrypt to shorten default certificate validity to 64 days in 2027
Cyber fraud now ranks above ransomware as CEOs’ top concern
Online workshop covers the role of information security officers
US seizes two China-linked hacking tools used against critical infrastructure
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
AI security patches often stop crashes but fail maintainers’ tests
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Canadian cybersecurity executive arrested on extortion-related charges
Phone settings can help block spam calls and scam texts
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
