Federal Agencies Face Today’s Deadline to Patch Five Flax Typhoon CVEs Spanning a Decade
Photo: Forkast
Federal agencies face a hard deadline today, October 11, 2026, to remediate or discontinue use of five specific software products identified by CISA as actively exploited by the threat actor Flax Typhoon, also known as Ethereal Panda or Red Juliett. The Known Exploited Vulnerabilities catalog update, issued October 8, highlights a persistent security failure: the reliance on legacy software. The vulnerabilities span over a decade, from 2015 to 2023, with the oldest entry, CVE-2015-3306 in ProFTPD mod_copy, dating back 11 years. This vulnerability carries a CVSS score of 10.0, underscoring the risk inherent in maintaining unpatched, aging infrastructure.
Source: Forkast
