Daily brief · 2026-10-09

Multiple Products Under Active Attack + 6 More Fixes

▶

Multiple Products (ProFTPD, ONLYOFFICE, Strapi, Apache Struts, ISC BIND)

The Cybersecurity and Infrastructure Security Agency has added five new vulnerabilities to its Known Exploited Vulnerabilities catalog, impacting Multiple Products (ProFTPD, ONLYOFFICE, Strapi, Apache Struts, ISC BIND). The additions include an improper access control vulnerability in ProFTPD that allows remote attackers to read and write to arbitrary files using specific site commands. The update also covers a path traversal flaw in ONLYOFFICE Docs that could result in remote code execution, a cleartext storage vulnerability in Strapi, a command injection flaw in Apache Struts, and a data processing error in ISC BIND.

Why it matters: If exploited, attackers can achieve arbitrary file read and write access, execute remote code, discover sensitive data, or cause a denial of service.

What to do: Apply the latest security patches or discontinue use of end-of-life versions.

CVEs: CVE-2015-3306, CVE-2021-3199, CVE-2023-22894, CVE-2016-3081, CVE-2015-5477

MonsterCloud

Zohar Pinhasi, the owner of the ransomware remediation firm MonsterCloud, has been arraigned on wire fraud charges for secretly paying hackers while defrauding his clients. Operating under the aliases Zack Silver and Zack Green, Pinhasi charged clients millions of dollars and falsely represented that he could decrypt ransomware without paying cybercriminals, claiming to offer a principled alternative.

Why it matters: This deceptive practice meant that clients were significantly overcharged, while the ransom demands were still being secretly paid to the cybercriminals.

What to do: Be cautious of ransomware remediation services that promise proprietary decryption capabilities without transparency.

US Critical Infrastructure Sectors

A new advisory reveals that Chinese government-linked cyber actors, enabled by the Integrity Technology Group, are conducting global cyberespionage campaigns targeting US Critical Infrastructure Sectors. These threat actors are combining automated scanning tools, large-scale botnets, and hands-on exploitation techniques to target and steal sensitive data from organizations worldwide, leveraging newly added known exploited vulnerabilities.

Why it matters: The attackers are establishing persistent access through VPNs and exfiltrating sensitive data, credentials, and emails.

What to do: Disable unused services, sanitize web inputs, enforce MFA, and apply timely patches.

Multiple Atlassian Data Center Products

Atlassian has released updates to patch a critical path traversal vulnerability in Multiple Atlassian Data Center Products that allows unauthorized file access. Attackers can exploit this flaw to gain unauthenticated access to sensitive configuration files and credentials.

Why it matters: This vulnerability allows attackers to access sensitive configuration files, credentials, and security tokens.

What to do: Patch affected Atlassian Data Center products immediately.

CVEs: CVE-2026-21589

Red Lion Controls N-Tron 700 Series

CISA has published an advisory outlining vulnerabilities affecting Red Lion Controls N-Tron 700 Series switches. These flaws specifically impact firmware versions 3.11.0 and earlier. If successfully exploited, a malicious user could gain administrative access to the compromised device. This access would allow the attacker to alter configuration files or force the switch into continuous reboots.

Why it matters: This matters because attackers could view, edit, and upload new configuration files, or cause the affected hardware to continuously reboot.

What to do: Apply the appropriate updates or mitigations provided by the vendor.

CVEs: CVE-2026-32645, CVE-2026-39460, CVE-2026-28745, CVE-2026-33367, CVE-2026-29797, CVE-2026-39453, CVE-2026-33272

Integrity Technology Group (Flax Typhoon)

The US Justice Department and the FBI have dismantled two hacking tools utilized by Chinese state-sponsored threat actors. Through court-authorized seizures, authorities denied these malicious groups access to tools known as Microscan and FishHub, which were used to scan and hack networks. These tools were operated by the China-based Integrity Technology Group (Flax Typhoon). The operation disrupted efforts targeting critical infrastructure across both the United States and foreign networks.

Why it matters: This development is significant because critical infrastructure systems in the U.S. and around the world were targeted and potentially compromised by these activities.

What to do: Review indicators of compromise and apply recommended mitigations against Flax Typhoon activity.

Integrity Technology Group

The United Kingdom’s National Cyber Security Centre, along with international partners, has published a joint advisory detailing malicious operations by the China-linked Integrity Technology Group. The report reveals how this organization has facilitated cyber actors in exploiting and compromising global networks. These malicious actors are reportedly utilizing artificial intelligence tools and botnets to carry out their compromises.

Why it matters: These operations are concerning because attackers can compromise networks and steal confidential data globally.

What to do: Implement the protective measures outlined in the joint advisory to defend against these techniques.

Tags: multiple-products, monstercloud, us-critical-infrastructure-sectors, multiple-atlassian-data-center-products, red-lion-controls-n-tron-700-series, integrity-technology-group