U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog
CISA added five exploited ProFTPD, ONLYOFFICE, Strapi, Struts, and BIND flaws to the KEV catalog.
78
Product
Microsoft Exchange
- Mentions · 7d0
- Mentions · 30d10
- All mentions20
- First seenAug 26, 2026
- Last mentioned19d ago
Timeline
20 articles · newest firstFlax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
CISA added five Flax Typhoon-exploited flaws to the KEV catalog, with a federal patch deadline of October 11.
86
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive Data
FBI and partners warn China-linked Integrity Technology Group uses scanning, botnets, and hands-on access to steal data.
81
FBI Seized Vulnerability Scanning and Spear Phishing Tools Used by China-Linked Hackers
The FBI seized seven domains for Microscan and FishHub tools used by China-linked Flax Typhoon contractor Integrity Technology Group.
78
US disrupts Chinese hacking tools as 7 govts warn of PRC spies stealing sensitive data worldwide
FBI seized seven Flax Typhoon-linked domains as seven governments warned of PRC data theft.
82
FBI disrupts Chinese hacking tools used to breach critical infrastructure
FBI seized Flax Typhoon domains for tools used in critical-infrastructure intrusions.
86
DOJ, FBI seize Flax Typhoon-linked hacking tools Microscan, FishHub
DOJ and FBI seized Flax Typhoon tools Microscan and FishHub tied to China's Integrity Technology Group.
80
International coalition seizes tools used by cyber firm behind Flax Typhoon
A US-led coalition seized Flax Typhoon tools Microscan and FishHub operated by China's Integrity Tech.
80
FBI Says China-Linked Hackers Ran Portal Giving Third Parties Access to Stolen Emails
FBI and six countries say China-linked Integrity Technology Group stole emails and shared them via a third-party portal.
79
Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data
Joint advisory says Integrity Technology Group-enabled Chinese actors steal data from critical infrastructure using botnets and hands-on hacking.
82
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle espionage group used GhostContainer, BlueKeep exploitation, and DCSync attempts to compromise Russian organizations and target Active Directory controllers.
75
Hacking group ‘NightEagle’ targeting China’s high-tech sector expands operations to Russia
Kaspersky reports the NightEagle espionage group (APT-Q-95) expanded from China-focused targets to Russian companies, backdooring Microsoft Exchange servers with GhostContainer using stolen VPN credentials.
68
FamousSparrow Exploits Public-Facing Exchange Servers to Deploy SparroWocky Backdoor
ESET attributes a new SparroWocky backdoor to espionage group FamousSparrow, deployed via exploited internet-facing Exchange servers across Latin American governments.
78
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
NightEagle (APT-Q-95) breached Russian firms using stolen VPN credentials, a GhostContainer Exchange backdoor, Dev Tunnels abuse, and DCSync.
74
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, BlueKeep exploitation, and covert tunneling for espionage.
74
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
Kaspersky links NightEagle (APT-Q-95) intrusions in Russia to stolen VPN credentials, the GhostContainer Exchange backdoor, and Microsoft Dev Tunnels abuse.
72
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Kaspersky details NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises with Exchange backdoors, Gorilla RAT, and destructive Monkey ransomware.
76
NightEagle targets Russian companies
Kaspersky links NightEagle (APT-Q-95) attacks on Russian firms to compromised VPN credentials, a GhostContainer Exchange backdoor, RDP tunneling, BlueKeep exploitation, and DCSync.
74
Microsoft’s September 2026 Patch Tuesday addresses 964 CVEs (CVE-2026-81963, CVE-2026-85880)
Microsoft's September 2026 Patch Tuesday fixes a record 964 CVEs, including two zero-days actively exploited in the wild.
85
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
78
Related CVEs
by mentions- CVE-2015-330699%10.0Arbitrary file read/write via ProFTPD 1.3.5 mod_copy
- CVE-2019-0708100%9.8Unauthenticated RCE in Microsoft Remote Desktop Services (BlueKeep)
- CVE-2021-319930%9.8Path Traversal RCE in ONLYOFFICE Document Server
- CVE-2020-0688100%8.8RCE in Microsoft Exchange Server from Shared Install-Time Validation Keys
- CVE-2016-308197%8.1Command injection RCE in Apache Struts Dynamic Method Invocation
- CVE-2015-5477100%7.5Remote denial of service in ISC BIND via TKEY queries
- CVE-2023-228944%4.9Sensitive-data leak in Strapi admin query filters (through 4.5.5)
- CVE-2019-11510100%10.0Unauthenticated Arbitrary File Read in Ivanti Pulse Connect Secure VPN
- CVE-2021-22205100%10.0Unauthenticated RCE in GitLab CE/EE via ExifTool Image Parsing (CVE-2021-22205)
- CVE-2014-6278100%—Remote OS Command Injection in GNU Bash via Crafted Environment (Shellshock-family)
Appears with
- Microsoftvendor · 18
- Flax Typhoonthreat actor · 8
- APT-Q-95threat actor · 7
- NightEaglethreat actor · 7
- GhostContainermalware · 7
- CISAorganization · 7
- Kasperskyvendor · 7
- FBIorganization · 6
- FishHubproduct · 5
- Miraimalware · 5
- Integrity Technology Grouporganization · 5
- Apache Strutsproduct · 5
- Microscanproduct · 5
- Federal Bureau of Investigationorganization · 4
- Integrity Technology Groupthreat actor · 4
- Apachevendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.