Pick any internet-facing server in your estate and ask when it was last patched against a bug from 2015. Most teams would say never, because that bug was fixed a decade ago and the question feels silly. Then, on Thursday, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalogue because a China-linked group tracked as Flax Typhoon has been using them, and the oldest dates from 2015.
The list
As reported by The Hacker News, the additions are CVE-2015-3306 (ProFTPD, CVSS 10.0, arbitrary file read and write through the site cpfr and site cpto commands), CVE-2021-3199 (ONLYOFFICE Docs, 9.8, a path traversal that can lead to code execution), CVE-2016-3081 (Apache Struts, 8.1, command injection when Dynamic Method Invocation is on), CVE-2023-22894 (Strapi, 7.2) and CVE-2015-5477 (ISC BIND, 7.5, a denial of service through crafted TKEY queries). Three more flaws in the same set of eight were already in the catalogue: Shellshock, an Ivanti Pulse Connect Secure file read and a GitLab remote code execution bug. US federal agencies were given until 11 October to patch or stop using the affected products.
The additions arrived alongside a joint advisory from agencies in the US, UK, Australia, Canada, Japan, New Zealand and Spain. It concerns activity enabled by Integrity Technology Group, a China-based security company. According to the report, the operations used scanning, cross-site scripting and password spraying against Microsoft Exchange for initial access, kept their foothold through VPN software, and used scripts to pull out mail and credentials. CISA's Chris Butera is quoted saying Chinese government-affiliated actors continue to position themselves inside critical infrastructure, including operational technology.
Why old bugs keep their value
Nobody needs a zero-day to get into an organisation that still runs a forgotten FTP daemon. The problem is rarely that a team decided to leave a hole open. It is that the server was never on anyone's list. It sits behind a name nobody recognises, was stood up for a project that ended, and does not show in the vulnerability scanner because the scanner's scope was drawn around the systems people remember. An attacker who scans the whole internet does not share that blind spot.
It is also a reminder that the headline severity score is a poor guide to priority. A 7.2 on a content-management admin panel that is exposed to the internet matters more than a 9.8 on something unreachable. What decides the order is exposure and evidence of exploitation, and the KEV catalogue is the cheapest evidence you can get for free.
What to do with this, practically
- Check your external attack surface for ProFTPD, ONLYOFFICE Docs, Strapi, Struts and BIND, including instances that belong to a supplier or an acquired company.
- Subscribe someone to KEV additions and give them the authority to open an urgent ticket on a match, not just forward an email.
- For products you cannot patch, decide now whether to isolate them or retire them. "Patch or discontinue" is a fair summary of the choice.
- Review Exchange and VPN logs for password spraying and unexpected configuration changes, since that is how this group is described as getting in and staying.
- Compare your asset inventory with what an outside scan actually finds. The gap between the two lists is your real exposure.
The report does not say how many organisations were compromised, and the advisory itself is the place to find indicators. We would start with the inventory gap. If you want a hand running that comparison, email sales@halfteck.com.