Why a 2015 BIND Bug Is Now on CISA's Must-Patch List: Inside Advisory AA26-281A

On October 8, 2026, CISA added ISC BIND, Apache Struts, ProFTPD, ONLYOFFICE Docs and Strapi flaws to its Known Exploited Vulnerabilities catalog, with a federal deadline of October 11. The oldest is from 2015. None is new. They appeared because a joint advisory, AA26-281A, named them as bugs a China-based company's tooling has exploited, and the catalog follows the evidence regardless of age.

The argument here is narrow. The listing says little about any single old bug and a lot about how the actor works: it runs a large library of exploit checks against whatever is exposed and takes what answers.

What the advisory says

The advisory, issued by the FBI, CISA and the NSA with agencies from the United Kingdom, Australia, Canada, Japan, New Zealand and Spain, describes cyber actors enabled by Integrity Technology Group. CISA calls it "a China-based company with links to the Chinese government." The activity overlaps with what vendors track as Flax Typhoon, Ethereal Panda and Red Juliett, though the advisory warns that those names may not map one to one to government attribution.

Targets in the United States span government services, critical manufacturing, healthcare and information technology, plus law enforcement, education and religious organisations. Observed email-theft victims were in Southeast Asia.

The tooling is ordinary. The advisory names open-source scanners (masscan, NMAP, wpscan, dirsearch), the EBurst password-spraying tool for Exchange and Office 365, SoftEther VPN for persistence, and secretsdump and JuicyPotato for credentials and privilege escalation. The distinctive piece is MicroScan, which the advisory describes as a Python web application with over 1,300 penetration-testing scripts, used since 2017 against services including OpenSSL, Oracle WebLogic, Jenkins and Apache Struts.

The five new entries

The advisory lists eight CVEs the actors exploited successfully. Five were new to the catalog. Three were already there.

CVE	Product	Advisory impact	New to catalog
CVE-2015-3306	ProFTPD 1.3.5	Unauthorised read	Yes
CVE-2015-5477	ISC BIND 9.x	Denial of service	Yes
CVE-2016-3081	Apache Struts	Remote code execution	Yes
CVE-2021-3199	ONLYOFFICE DocumentServer	Unauthorised write	Yes
CVE-2023-22894	Strapi	Information disclosure	Yes
CVE-2014-6278	GNU Bash	Remote code execution	No
CVE-2019-11510	Pulse Connect Secure	Unauthorised read	No
CVE-2021-22205	GitLab	Remote code execution	No

CISA's catalog entries add conditions. The Struts bug needs Dynamic Method Invocation enabled. The ONLYOFFICE path traversal leads to code execution when JWT is enabled. The ProFTPD flaw allows remote reads and writes through the SITE CPFR and SITE CPTO commands. The Strapi entry says the product may be end of life and chains to remote code execution.

The BIND entry is the odd one. CVE-2015-5477 is a remote denial of service through TKEY queries, and a crash is not what a spy wants. Its presence suggests the catalog is recording what the toolkit successfully triggers, not what the actors finally cared about.

The counter-case

A skeptic can reasonably say these additions inflate the federal workload for little gain. A 2015 ProFTPD bug on an agency network is probably long gone, and a fixed deadline of three days for a DNS crash bug competes with patching the current Cisco, Ivanti and Palo Alto problems. That cost is real.

The response is in the dates. The advisory says MicroScan has been in use since 2017, and The Hacker News reports it was still reachable through the domain c0cc[.]cc on September 9, 2026. A tool that old keeps producing hits only if old software is still exposed somewhere.

What the FBI did around it

The Justice Department and FBI seized seven domains tied to MicroScan and a spear-phishing tool called FishHub, according to court documents unsealed in the Western District of Pennsylvania. The Hacker News says about 20 Taiwanese universities were confirmed FishHub victims.

FBI Cyber Division Assistant Director Brett Leatherman said: "The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity." The same report says the UK's National Cyber Security Centre said actors enabled by Integrity Tech are using AI tools such as automated scanning alongside botnets and manual exploitation.

A spokesperson for Australia's signals directorate said, in comments carried by iTnews that the advisory's techniques "are applicable to Australian entities," although Australia was not among the victim locations it names.

What to check

The advisory's mitigations are generic: disable unused services and ports, require multi-factor authentication on webmail and VPNs, replace default passwords and segment networks. The specific checks follow from the table. Look for any internet-facing ProFTPD 1.3.5, BIND 9.x, Struts, ONLYOFFICE or Strapi instance, and for unexpected Active Directory replication, which would indicate the DCSync tool the advisory lists.

The pattern repeats elsewhere this month. The Ivanti Connect Secure zero-day is a new bug used by attackers. This advisory is the opposite case: old bugs used by a patient actor. Microsoft's October Patch Tuesday shows how large the new-bug queue already is.

What would change this reading

The advisory does not say how many victims were reached through each of the five older flaws, or whether the DNS bug was exploited against a live target. If CISA or the FBI publishes victim counts per vulnerability, the BIND entry could be shown to be a toolkit artefact. Until then, the October 11 deadline stands for federal agencies, and the safe course for everyone else is to find and retire the five products above.