U.S. CISA adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND flaws to its Known Exploited Vulnerabilities catalog

CISA added five high-severity vulnerabilities (including ProFTPD CVE-2015-3306, ONLYOFFICE CVE-2021-3199, Strapi CVE-2023-22894, Apache Struts CVE-2016-3081, ISC BIND CVE-2015-5477) to its Known Exploited Vulnerabilities catalog after linking them to a China-associated campaign by actors tied to Integrity Technology Group that used large-scale scanning, XSS, password spraying, spear-phishing and tools (Microscan, FishHub) to gain access and steal data; a joint international advisory was issued and U.S. authorities seized alleged tooling while ordering federal agencies to remediate by October 11, 2026.