ProFTPD improper access control vulnerability allowing remote attackers to read and write arbitrary files. Exploited by China-linked Flax Typhoon APT group. CVSS 10.0 critical severity with active in-the-wild exploitation.
Immediately patch all affected ProFTPD systems. Federal agencies must comply with CISA's October 11, 2026 remediation deadline. Audit systems for indicators of compromise.
Source: CISA • Published: 2026-10-09
ONLYOFFICE Docs path traversal vulnerability enabling remote code execution. Added to CISA KEV catalog following exploitation by Flax Typhoon threat actor. CVSS 9.8 critical severity.
Update ONLYOFFICE Docs to the latest patched version immediately. Federal agencies have October 11, 2026 deadline. Scan for unauthorized access and malicious file modifications.
Source: CISA • Published: 2026-10-09
Cisco Smart Software Manager On-Prem improper verification of cryptographic signature vulnerability. CVSS 10.0 critical severity allowing complete bypass of cryptographic controls.
Apply Cisco security updates immediately. Review all license management systems for unauthorized access. Implement enhanced cryptographic verification monitoring.
Source: Cisco PSIRT • Published: 2026-10-07
Strapi cleartext storage of sensitive information vulnerability exploited by Flax Typhoon APT. CVSS 7.2 high severity allows attackers to access sensitive data stored in cleartext.
Upgrade Strapi to patched version by October 11, 2026. Review stored credentials and sensitive data for exposure. Implement encryption for sensitive information storage.
Source: CISA • Published: 2026-10-09
Apache Struts command injection vulnerability allowing remote code execution. Exploited by China-based Flax Typhoon group. CVSS 8.1 high severity.
Immediately update Apache Struts to fixed versions. Federal agencies must remediate by October 11, 2026. Audit web applications for unauthorized access or webshells.
Source: CISA • Published: 2026-10-09
ISC BIND reachable assertion vulnerability causing denial-of-service. Added to CISA KEV following Flax Typhoon exploitation. CVSS 7.5 high severity.
Patch ISC BIND to latest secure version immediately. Monitor DNS infrastructure for service disruptions. Federal deadline October 11, 2026.
Source: CISA • Published: 2026-10-09
Tensorlake 0.5.144 npm release contains malicious payload hijacking developer and CI environments. ChainDrop/Shai-Hulud-style supply chain attack establishes PowerShell persistence and executes remote code. Flagged by Socket October 8, 2026.
Block Tensorlake version 0.5.144 immediately. Rotate all credentials potentially exposed during installation. Scan environments for PowerShell persistence mechanisms and remote access backdoors.
Source: Socket • Published: 2026-10-08
Critical pre-authentication unauthenticated RCE in Cisco Secure Firewall Management Center exploited by Interlock ransomware as zero-day. CVSS 10.0 insecure deserialization allows root access and pivot to Firepower Threat Defense devices.
Upgrade to Cisco fixed releases immediately. Audit affected systems for compromise using admin-tech files. Review all management plane access for unauthorized activity.
Source: Cisco PSIRT • Published: 2026-10-07
China-linked APT Flax Typhoon exploited five vulnerabilities in coordinated campaign. FBI/DOJ seized Microscan and FishHub hacking tools plus seven domains operated by Integrity Technology Group. Built Mirai botnet of IoT devices for vulnerability scanning and network infiltration via spear phishing.
Patch all five CISA KEV vulnerabilities by October 11 deadline. Hunt for Microscan/FishHub indicators. Review IoT device security. Enhance spear phishing defenses and email security controls.
Source: CISA • Published: 2026-10-09
Record 950 ransomware attacks in 30 days by 86 groups. The Gentlemen group led with 141 victims (14.8%). SafePay escalated 1,300% from 3 to 42 victims. US sustained 395 attacks (41.6%). Average ransom demand $602,400.
Implement multi-layered ransomware defenses: offline backups, network segmentation, EDR solutions. Enhance detection capabilities. Test incident response plans. Deploy zero-trust architecture.
Source: Threat Intelligence • Published: 2026-10-07
Interlock ransomware group exploited CVE-2026-20131 as zero-day to gain root access to Cisco Secure Firewall Management Center. Enabled pivot from management servers to Firepower Threat Defense devices for ransomware deployment.
Apply Cisco patches immediately. Audit all Firewall Management Center deployments for IOCs. Review network segmentation between management and production. Implement enhanced monitoring for management plane.
Source: Cisco PSIRT • Published: 2026-10-07
Major Danish data breach exposed names, addresses, and personal identification numbers of 8.8 million people in Central Person Register. Unauthorized access via misused legitimate company credentials. Separate DTU breach exposed up to 200,000 users via compromised identity and access management system.
Affected individuals should monitor for identity theft and fraud. Organizations with CPR access must review access controls, audit logs, and implement enhanced authentication. Rotate all administrative credentials.
Source: BleepingComputer • Published: 2026-10-01
Ernst & Young cyber breach exposed personal and financial information of Goldman Sachs and Man Group clients. Compromised platform supported EY tax services. Exposed data includes names, addresses, tax IDs, emails, and financial details.
Affected clients should monitor financial accounts and credit reports for fraud. EY must strengthen third-party platform security controls. Implement enhanced data loss prevention and access monitoring.
Source: BleepingComputer • Published: 2026-10-01
Google Threat Intelligence found vulnerability disclosures doubled from 5,045 (January 2026) to 10,740 (August 2026). Average monthly exploited vulnerabilities rose from 10.5 (2025) to 18 (Jan-Aug 2026). GTIG tracked 2,076 AI software vulnerabilities, over 1,500 in 2026 alone. Half affect agent orchestration frameworks like Flowise and Langflow.
Accelerate patch management cycles to counter AI-driven exploitation. Prioritize vulnerabilities in AI orchestration frameworks and edge devices. Implement automated vulnerability scanning and threat intelligence integration.
Source: GTIG • Published: 2026-10-01
CVE-2015-3306: ProFTPD improper access control vulnerability allowing remote attackers to read and write arbitrary files. Exploited by China-linked Flax Typhoon APT group. CVSS 10.0 critical severity with active in-the-wild exploitation.