Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

CISA added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following active exploitation by Flax Typhoon, a China-linked threat actor. One of the key vulnerabilities is CVE-2015-3306 (CVSS 10.0), an improper access control flaw in ProFTPD. CISA set an October 11 deadline for federal agencies to remediate the identified vulnerabilities. Flax Typhoon is a state-sponsored Chinese threat group known for targeting critical infrastructure and government entities. The addition to the KEV catalog signals active in-the-wild exploitation of these flaws. Federal agencies are required to patch or mitigate the listed vulnerabilities before the deadline. The article highlights the ongoing threat posed by Chinese APT groups leveraging known vulnerabilities in widely used software.