IT Daily Roundup: October 10, 2026
1. FBI took down Flax Typhoon's infrastructure, CISA ordered patches for five old CVEs
On October 9, 2026, the FBI seized seven domains and disrupted tools used by Flax Typhoon, a China-linked threat group also tracked as Ethereal Panda and RedJuliett. The group is tied to Integrity Technology Group, a Beijing-based company that, according to a federal court affidavit, was running a database of over 1.2 million compromised devices worldwide as of June 2024, including 385,000 in the US. Flax Typhoon operated Microscan, a Python-based scanner with more than 1,300 exploitation scripts, a botnet managed via the Sparrow application, and FishHub, a spear-phishing tool. Confirmed victims included a South Carolina power company, airports in Japan and Poland, and utility companies in Taiwan.
At the same time, CISA added five vulnerabilities actively exploited by Flax Typhoon to its Known Exploited Vulnerabilities catalog: CVE-2015-3306 in ProFTPD (CVSS 10.0, unauthenticated arbitrary file read/write), CVE-2021-3199 in ONLYOFFICE Docs (CVSS 9.8, path traversal leading to RCE), CVE-2016-3081 in Apache Struts (CVSS 8.1, command injection via Dynamic Method Invocation), CVE-2023-22894 in Strapi (CVSS 7.2, cleartext storage of sensitive data), and CVE-2015-5477 in ISC BIND (CVSS 7.5, DoS via TKEY query). Federal agencies must patch or stop using the affected software by October 11, 2026.
Why it matters: Three of the five CVEs are more than ten years old. The ProFTPD and BIND flaws date back to 2015. Flax Typhoon exploited them anyway. Check whether your environment or your vendors run ProFTPD, ONLYOFFICE Docs, Apache Struts, Strapi, or an older version of ISC BIND. These products tend to show up in forgotten servers or old test environments. The CISA KEV catalog is a practical list to compare against the software versions running in your infrastructure.
2. Cisco patched 35 vulnerabilities including critical flaws in NX-OS, Meraki, and APIC
Cisco released patches on October 8, 2026 for 35 vulnerabilities, more than a dozen of them rated critical. In NX-OS, CVE-2026-76471 and CVE-2026-76465 allow a remote, unauthenticated attacker to execute code with root privileges or cause denial of service. The flaws primarily affect Nexus 3000 and 9000 switches with Next Generation OAM enabled. License On-Prem received patches for CVE-2026-20328 (unauthorized access without authentication) and CVE-2026-76454 (DoS). In Meraki, Cisco fixed CVE-2026-76464, a memory-related flaw. APIC received patches for CVE-2026-76498, CVE-2026-76499, and CVE-2026-76500, covering access control, OS injection, and memory issues. A publicly disclosed server-side request forgery flaw, CVE-2026-20362, was also patched in Finesse. Cisco says none of the fixed vulnerabilities are being actively exploited.
Why it matters: Cisco Meraki is a common networking platform in smaller companies for Wi-Fi and switching. The critical CVE-2026-76464 in Meraki is a good reason to verify the current firmware version. For environments running NX-OS or APIC, the priority is the flaws that allow remote access without authentication. Cisco has published the exact patched versions for each product in its security advisories.
3. AhsayCBS backup software is being actively exploited and the available patch does not work
Attackers have been actively exploiting two vulnerabilities in AhsayCBS, a backup solution from Hong Kong-based Ahsay, since October 7, 2026. CVE-2026-105133 (CVSS v4: 5.5) allows bypassing authentication via the checkSysPwd() function. CVE-2026-105134 (CVSS v4: 9.3) is an OS command injection flaw in the Replication Receiver component. Chained together, they let a remote, unauthenticated attacker run arbitrary commands on the server.
After gaining access, attackers deployed web shells, dropped an XMRig cryptominer renamed to edge.exe to impersonate Microsoft Edge, and downloaded the vulnerable WinRing0x64.sys driver using certutil.exe. A PowerShell script pauses the miner when Task Manager is open and restarts it after it closes. The vendor released version 10.3.4 as a fix, but Huntress confirmed that version is also vulnerable, making the flaws effectively zero-days.
← All postsWhy it matters: AhsayCBS is not a widely deployed product, but backup solutions are often managed by IT service providers on behalf of clients and are not always easy to spot. There is no working fix. Both Huntress and the vendor recommend restricting access to the AhsayCBS management interface to VPN or trusted IP addresses until a real patch arrives. On affected servers, check running processes and look for edge.exe or WinRing0x64.sys in unexpected locations.