The old bugs were due today

Three days. The bugs are older than that.

On 8 October CISA put five entries on the KEV list and told civilian federal agencies to be finished today. BIND, CVE-2015-5477: a data-processing error that can take the resolver down with TKEY queries. Apache Struts, CVE-2016-3081: command injection when Dynamic Method Invocation is on. ProFTPD, CVE-2015-3306: improper access control that can read and write files through two SITE commands. ONLYOFFICE Docs, CVE-2021-3199: a path traversal on an image-upload parameter when JWT is used, which can become code execution. Strapi, CVE-2023-22894: cleartext storage that lets someone already in the admin panel recover user details through a query filter. Ransomware use is marked unknown on all five. Four of them carry the BOD 26-04 forensic-triage flag.

The same day’s joint advisory, AA26-281A, is why these particular fossils are on a three-day clock. FBI investigations of Integrity Technology Group, a China-based company the authoring agencies say is linked to the Chinese government, recovered scripts that used them. The actors enabled by that company are described as consistent with activity the industry calls Flax Typhoon, Ethereal Panda, and Red Juliett. The advisory also names older KEVs that were already on the list: Shellshock, Pulse Connect Secure, GitLab. I am not repeating the commands.

What the ticket will do with 2015

It will close on a version string, because the due date is today and the scanner wants a green cell. The triage line is the part that dies in that rush. CISA’s own implementation note says to collect the evidence before you patch, because the patch can wipe the artifact the look was for. An agency that rebuilt BIND on Thursday and skipped memory has met the date and missed the order.

If you still have ProFTPD 1.3.5, or Struts with DMI on, or an ONLYOFFICE box that takes an image upload with JWT, the date is not a suggestion. It is also not a finding that a 2015 FTP daemon is a state-level surprise. It is a finding that a script library still hits it, and that the people who wrote the script library already have a copy of the result. “We do not run 2015 software” is a sentence you have to check, not a sentence you get to assume because the calendar says 2026.

The deadline is today. The bugs are from a previous decade. The look is what the three days were for.