Back to Fastnexa
Under attack?
CyberBrief
Subscribe
Fastnexa

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

Used in attacksCriticalCVSS 10.0The Hacker News · info@thehackernews.com (The Hacker News)·

At a glance

Severity
CriticalCVSS 10.0
Used in attacks
Yes, 1 of 1 flaw named
Flaws named
CVE-2015-3306
Industries
Government
Reported by
1 outlet

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow…

Read the full story at thehackernews.com ↗Established Source

We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what CyberBrief adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.

Vulnerabilities referenced

  • CVE-2015-330610.0Critical

    ProFTPD ProFTPD

    ProFTPD contains an improper access control vulnerability that could allow remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.

    Used in attacks

    Added to CISA's list 2026-10-08 · Exploit code published

    Full record →

Fastnexa security experts

This story involves a flaw attackers are already using. Are you exposed?

A Fastnexa penetration tester can check whether CVE-2015-3306 or anything like it can be used against your websites, apps and network.

Book a 30-min callWhatsApp us

Think you’ve already been hit? Don’t wait on a form: call or WhatsApp +1 (732) 454 2616. We reply within 1 hour, 24/7. Emergency help →

Coverage

One outlet has carried this so far.

  1. The Hacker News ↗Established SourceFirst reported

    2026-10-09 12:21 UTC

Related stories