🚨 ACTIVE EXPLOITATION
CISA adds ProFTPD mod_copy flaw CVE-2015-3306 to KEV catalog
CVE-2015-3306
CISA has added CVE-2015-3306, an improper access control flaw in ProFTPD, to its Known Exploited Vulnerabilities catalog.- Applies to organizations running ProFTPD, notably version 1.3.5 with the mod_copy module enabled
- SITE CPFR and SITE CPTO commands work without authentication, letting remote attackers copy arbitrary files readable or writable by the FTP process
- Exploitation enables data theft (e.g. SSH keys, /etc/passwd) and can escalate to remote code execution
- CVSS 10.0 with EPSS ~96.8%; multiple public PoC exploits exist; KEV remediation due 2026-10-11
CISA adds exploited ISC BIND flaw CVE-2015-5477 to KEV catalog amid China-linked hacking advisory
CVE-2015-5477
CISA added the exploited ISC BIND denial-of-service flaw CVE-2015-5477 to its KEV catalog after a joint FBI advisory tied it to China-linked hackers.- Applies to organizations running ISC BIND DNS servers; affected versions are BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3.
- The flaw is a data processing error that lets remote attackers crash the DNS server via TKEY queries, causing denial of service.
- A joint advisory from the FBI and agencies in 6 other countries lists CVE-2015-5477 among 8 flaws successfully exploited by hackers linked to China-based Integrity Technology Group.
- The hackers scan for flaws using open-source tools like Nmap, masscan, WPScan, and a Python scanner called MicroScan with over 1,300 scripts, targeting ports 21, 22, 53, 80, 443, and 1080.
- KEV entry added 2026-10-08 with a remediation due date of 2026-10-11 under BOD 26-04; AWS says its services are not affected.
Apache Struts CVE-2016-3081 added to CISA KEV amid China-linked exploitation
CVE-2016-3081
CISA added the Apache Struts command injection flaw CVE-2016-3081 to its KEV catalog after a joint advisory tied its exploitation to China-linked hackers.- Applies to organizations running Apache Struts 2.3.19–2.3.20.2, 2.3.21–2.3.24.1, and 2.3.25–2.3.28.
- The flaw allows remote code execution via method:prefix command injection, but only when Dynamic Method Invocation is enabled.
- Exploitation is attributed to hackers linked to China-based Integrity Technology Group, who used a Python scanner (MicroScan) with 1,300+ scripts against targets including Apache Struts.
- Fixed in Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1; disabling Dynamic Method Invocation is an alternative mitigation.
- KEV due date for federal remediation is 2026-10-11.
Strapi cleartext storage flaw CVE-2023-22894 added to CISA KEV catalog amid China-linked exploitation
CVE-2023-22894
CISA has added CVE-2023-22894, a Strapi cleartext storage of sensitive information vulnerability, to its Known Exploited Vulnerabilities catalog.- Applies to organizations running Strapi headless CMS; affected versions run up to 4.5.5 per the joint advisory, with Strapi's own advisory citing versions 3.2.1 through 4.7.9 (fixed in 4.8.0).
- The flaw is cleartext storage of sensitive information: attackers with admin panel access can discover sensitive user details via the query filter.
- It can be chained with CVE-2023-22621 to achieve remote code execution.
- The flaw is among 8 vulnerabilities the FBI and allied agencies say China-linked hackers tied to Integrity Technology Group (Flax Typhoon, Ethereal Panda, RedJuliett) exploited using open-source scanners and a Python tool with 1,300+ scripts.
- KEV listing added October 8, 2026, with a federal remediation due date of October 11, 2026 under BOD 26-04.
FakeGit malware campaign returns with 17,610 malicious GitHub repos pushing SmartLoader
The FakeGit malware campaign reactivated on GitHub with 17,610 fake repositories distributing SmartLoader and the StealC infostealer.- Developers and AI users searching GitHub for tools, including AI skills and MCP servers, are targeted by the FakeGit campaign, now at 17,610 repositories per Apiiro.
- The repos use convincing READMEs with a Download button pointing to a ZIP that installs SmartLoader, which delivers the StealC infostealer to steal credentials, sessions, and crypto wallet data.
- FakeGit resumed October 4, pushing over 13,000 repo updates in 34 hours (peaking at 2,999/hour); 97% of sampled commits only edited the README to re-aim existing repos at new payloads.
- The campaign survived takedowns by hosting payloads in forks, older files, release assets, and issue attachments; 71% of the fleet was missing from URLhaus before Apiiro's report.
- Most accounts are throwaway, but at least 700 appear to belong to legitimate developers; Island's July report documented 7,600 repos, 6,600 fake profiles, and 14 million downloads, with 800 repos impersonating AI skills and MCP servers.
hikvision-cve-2021-36260-exploitation — Cyber Security News
💥 BREACHES & INCIDENTS
- FBI: China-Linked Integrity Technology Group Ran Portal Selling Access to Stolen Emails
The FBI and six partner agencies say hackers tied to China's Integrity Technology Group have stolen email from governments and other organizations since 2021 and run a portal giving third parties access to it.- Targets include government organizations, law enforcement, healthcare systems, and religious institutions in Southeast Asia, plus U.S. government services, critical manufacturing, healthcare, IT, education, and religious groups in Africa and North America.
- Hackers scanned for flaws with Nmap, masscan, WPScan, and a Python scanner called MicroScan containing over 1,300 penetration testing scripts, and guessed passwords for Microsoft 365 and Exchange accounts before copying mailboxes.
- Eight vulnerabilities were successfully exploited, including CVE-2015-3306 (ProFTPD 1.3.5), CVE-2015-5477 (ISC BIND), CVE-2016-3081 (Apache Struts 2.3.19–2.3.28), CVE-2019-11510 (Pulse Connect Secure), CVE-2021-22205 (GitLab 11.9+), CVE-2021-3199 (ONLYOFFICE 5.1.5–5.6.2), and CVE-2023-22894 (Strapi up to 4.5.5); five were newly added to CISA's KEV catalog.
- A fake login XSS payload delivers a password-protected ZIP containing live700_v1.exe, which runs as DiagTrack.exe to mimic a legitimate Windows process; activity overlaps with tracked groups Flax Typhoon, Ethereal Panda, and RedJuliett.
- Integrity Technology Group, sanctioned by the U.S. (January 2025) and UK (December 2025), was previously linked to the Raptor Train botnet of 200,000+ devices disrupted by the FBI in September 2024.
🔓 CVEs & KEV
CVE-2026-14269 — IBM DataPower Gateway 10.6CD — CVSS 9.8 — IBM DataPower Gateway Heap Overflow Enables Unauthenticated Remote Code Execution
CVE-2026-14992 — IBM DataPower Gateway 10.6CD — CVSS 9.8 — IBM DataPower Gateway Buffer Overflow Enables Remote System Compromise
CVE-2026-107700 — ntharim dot-access — CVSS 9.3 — dot-access Code Injection Enables Remote Node.js OS Command Execution
CVE-2026-107696 — FFmpeg — CVSS 7.1 — FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.cFFmpeg...
CVE-2026-107695 — FFmpeg — CVSS 7.1 — FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing PlaylistFF...
CVE-2026-107332 — aws aws-toolkit-vscode — CVSS 6.8 — Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Vi...
🕵️ RESEARCH & DEEP DIVES
- Midnight Mimosa malware preinstalled in firmware of low-cost MediaTek Android phones
Bitdefender discovered malware dubbed Midnight Mimosa preinstalled in the firmware of low-cost Android phones, enabling ad fraud and residential proxy botnets.- Affects low-cost, multi-brand Android devices on MediaTek platforms, including Doogee S200 X, Cubot KINGKONG X, and counterfeit phones spoofing Samsung and Apple models; thousands of devices in 150+ countries over ~two years, most in Mexico, France, Italy, US, Germany, Brazil, Spain.
- Malware ships as platform-signed system apps (com.android.system.lite, com.android.sys.prot, com.android.sys.gmsprot) that cannot be uninstalled and