CISA, the FBI, the NSA and partners in six countries issued a joint advisory. It says Integrity Technology Group, a China-based security firm with ties to the Chinese government, supplies tools and hosting to hackers. The methods fit Flax Typhoon. The Hacker News reported that CISA also added five exploited flaws to its Known Exploited Vulnerabilities list on Thursday. US federal agencies must patch them or stop using the products by October 11, 2026.
The Hacker News said the actors used eight flaws in all. The five new ones sit in ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts and ISC BIND. Four let a remote attacker read files, run commands or knock a service offline. Strapi exposes user details to someone with admin access. Three of the five carry IDs from 2015 or 2016. Separately, the advisory says the actors target edge devices, which sit at the network border and are not closely monitored. The outlet also reported password spraying (trying common passwords on many accounts) against Microsoft Exchange. The sources do not say which flaws were used against which devices, or how many networks were breached.
Two points stand apart here: the actors favour lightly monitored edge devices, and several exploited flaws are years old. Teams can check whether they run these five products and have patched them.