NewsThe Hacker News2026-10-09 12:21 UTCPublic Sector Finance SME

Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon. The vulnerabilities in question are listed below - CVE-2015-3306 (CVSS score: 10.0) - An improper access control vulnerability in ProFTPD that could allow

CVE-2015-3306ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability
CVE-2015-3306proftpd: Sicherheitsluecke

Other advisories

CVE-2026-93150none
cgroup/cpuset: Make nr_deadline_tasks an atomic_t
osv:CVE-2026-93150none
cgroup/cpuset: Make nr_deadline_tasks an atomic_t
CVE-2026-89927none
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
osv:CVE-2026-89927none
KVM: x86: hyper-v: Clamp stimer deadline to avoid livelock
CVE-2026-73500none
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
CVE-2026-73500none
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
osv:MAL-2026-14004none
Malicious code in lock-deadline-guard (npm)
osv:CVE-2026-73500none
etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Other news entries

Newssecurityweek2026-09-27
Microsoft SharePoint Flaw CVE-2026-65660 Now Exploited in Attacks
Newsbleepingcomputer2026-09-24
FedRAMP VDR & VER: Daily Scans Are Only the Beginning
Newsarstechnica-security2026-09-23
FBI rushes to investigate if ShinyHunters hack of thousands of employees is real
Newscsoonline2026-09-22
The cyber AI parity window now has a deadline
Newsthehackernews2026-09-10
CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline
Newssecurityweek2026-08-31
McKesson Confirms Data Breach as Attacker Deadline Looms
Vulnerabilitysans-newsbites-mail2026-08-28
CISA Adds 10 CVEs to Known Exploited Vulnerabilities Catalog, Five with Three-day Mitigation Deadlines
Newstheregister-security2026-08-25
CISA slaps its tightest three-day patching deadline on perfect-10 Oracle flaw

Source: https://thehackernews.com/2026/10/flax-typhoon-exploits-five-flaws-as.html

Linked advisories

More on Deadline