Somewhere out there, a ProFTPD server from 2015 is still humming along, unpatched, like a forgotten Tamagotchi that somehow never died. Unfortunately, a state-backed hacking crew found it before its owner did. This week's lesson: the scariest vulnerabilities aren't always the shiny new zero-days. Sometimes they're the ones you stopped worrying about during the Obama administration.

Five Vintage Bugs, One Very Modern Problem

On October 9, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming they'd been abused by Flax Typhoon, a China-linked threat actor. The list reads like a museum tour: ProFTPD (CVE-2015-3306, CVSS 10.0), ONLYOFFICE Docs (CVE-2021-3199, CVSS 9.8), Apache Struts (CVE-2016-3081, CVSS 8.1), ISC BIND (CVE-2015-5477, CVSS 7.5), and the headless CMS Strapi (CVE-2023-22894, CVSS 7.2). Federal agencies have until October 11 to patch or pull the plug.

Those five join three oldies already in the catalog — Shellshock, Ivanti Pulse Connect Secure, and a GitLab remote code execution flaw — for a total of eight bugs Flax Typhoon used to get in, steal data, and stick around via VPN software. The warning came in a joint advisory from Australia, Canada, Japan, New Zealand, Spain, the U.K., and the U.S., which also called out Integrity Technology Group, a China-linked cybersecurity company, as an enabler of the attacks.

Your CMS Is Part of the Attack Surface

Notice that a content management system made the list. The Strapi flaw lets someone with admin panel access fish sensitive user details out through query filters — exactly the sort of "it's only the admin side" issue that gets deprioritized forever. CMS platforms sit right next to your user data, so "we'll update it next quarter" is a much riskier sentence than it sounds.

The bigger takeaway is that patching isn't a one-time event; it's a habit. CISA's own officials framed it plainly: Chinese government-affiliated actors keep positioning themselves inside critical infrastructure networks so they can disrupt things "at a future time of their choosing." Attackers don't need a novel exploit when an eleven-year-old one still opens the door. Every forgotten server, stale plugin, and "temporary" staging box is an invitation.

The hackers aren't getting smarter here — they're just betting that you won't read the changelog. Prove them wrong.

If your CMS or the servers behind it haven't had a proper update audit in a while, let our team help you hunt down the vintage vulnerabilities before somebody else finds them first.

Source: The Hacker News