grc-scanSecurity & governance
← Back to homethe latest briefing →
Patch tracker12 October 2026Archived edition

What to patch now

This edition was published on 12 October 2026 and is kept here unchanged as a record. The threats and cases it describes may have moved on — read the latest briefing for the current picture.

The takeaway

All five fixes this week are for software that's years old — not new flaws, but confirmed renewed attacks on tools businesses often forget they're still running.

  • Running a self-hosted FTP server (ProFTPD), DNS server (BIND) or document server (ONLYOFFICE Docs)? Confirm it's patched, or retire it.
  • Built a website or web app on Apache Struts or the Strapi CMS years ago? Check it's still on a supported version.
  • Anything here past its vendor's end-of-life date? Plan to replace it — a patch only buys time.

What to patch now — 12 October 2026

Source: CISA Known Exploited Vulnerabilities (KEV) catalog — the most recently added entries as of today. Every vulnerability below has been confirmed by CISA as actively exploited in the wild, meaning attackers are already using it, not just researching it. If you (or a supplier) run any of this software, treat it as urgent.

A quiet week for new additions. CISA added just five entries to the catalog since the last edition (5 October) — and all five are older vulnerabilities, from 2015 through 2023, newly confirmed as under renewed active exploitation rather than freshly discovered flaws. They're still worth fifteen minutes of your time below.

1. ProFTPD file-transfer server — a decade-old bug lets an outsider read and write files it shouldn't touch (CVE-2015-3306)

🛠️ ProFTPD · added 8 Oct 2026 · CISA fix-by date 11 Oct 2026 (1 day overdue)

What it is: "Improper access control" here means two of ProFTPD's own file-management commands — the ones used to copy files between folders — don't properly check whether the person issuing them is actually allowed to touch the file in question. That lets an outsider read files they have no business seeing, or write new ones, without a password. The flaw itself is over a decade old; what's new is CISA's confirmation that attackers are using it again today, against servers that were never patched.

Who's affected: Any business running its own ProFTPD server rather than a managed file-transfer service — for example, to let customers or suppliers upload large files, or move data between an office and a website. Most modern hosting doesn't use ProFTPD by default, so this mainly bites businesses with an older, self-managed server nobody's touched in years.

What to do: If you (or an IT provider) run ProFTPD, update to the latest version today — the project's own site (proftpd.org) carries the fix. If nobody can say for certain what version is running or why it's there, that's itself the sign to retire the server and move file transfers to a maintained, managed service.

2. ISC BIND DNS server — a decade-old bug lets an outsider knock it offline with one crafted query (CVE-2015-5477)

🛠️ ISC BIND · added 8 Oct 2026 · CISA fix-by date 11 Oct 2026 (1 day overdue)

What it is: BIND is server software that answers "what's the address for this website name?" lookups (DNS). This flaw lets an attacker send it a malformed query of a specific type ("TKEY") that the software mishandles badly enough to crash — a denial-of-service, not a break-in, but enough to take a business's domain, email or internal network lookups offline until someone restarts it. Like the ProFTPD bug above, this is old (2015); CISA added it now because it's seeing fresh exploitation.

Who's affected: Hardly any small business runs its own DNS server day-to-day — that job is usually handled by your domain registrar, web host or ISP. This matters mainly if you, or an IT provider, run BIND yourselves, for example for an internal company network, rather than relying on a provider's managed DNS.

What to do: If nobody in the business runs BIND directly, there's nothing to do here — but it's worth asking an IT provider who manages any in-house network infrastructure whether they do, and that it's current. If you do run it, update to a supported, patched version now.

3. Apache Struts — an old web-framework bug lets an attacker run their own commands on the server (CVE-2016-3081)

🛠️ Apache Struts · added 8 Oct 2026 · CISA fix-by date 11 Oct 2026 (1 day overdue)

What it is: Struts is a framework developers use to build web applications — think of it as scaffolding a custom website or portal is built on top of. This bug lets an attacker smuggle an operating-system command inside a web address, through a feature called "Dynamic Method Invocation", and have the server run it as if it were a legitimate instruction. First disclosed in 2016, it's exactly the kind of flaw that lingers in older, custom-built web apps nobody has rebuilt since.

Who's affected: Businesses with a bespoke web application or customer portal built years ago on Apache Struts — more common in sectors that commissioned custom software before today's update-friendly frameworks became standard. If your website runs on an off-the-shelf platform (WordPress, Shopify, Squarespace, Wix), this doesn't apply to you.

What to do: Ask whoever built or maintains any custom web application whether it uses Apache Struts, and if so, whether Dynamic Method Invocation is disabled and the framework is on a current, supported version (the project's own advisory is S2-032). An old, unmaintained Struts app is a strong candidate for retiring rather than another patch.

4. ONLYOFFICE Docs — a file-upload flaw can let an outsider run code on a self-hosted document server (CVE-2021-3199)

🛠️ ONLYOFFICE Docs · added 8 Oct 2026 · CISA fix-by date 11 Oct 2026 (1 day overdue)

What it is: ONLYOFFICE Docs is self-hosted software some businesses run instead of Google Docs or Microsoft 365, usually for cost or data-control reasons. This flaw is "path traversal" — a crafted image-upload request can sneak a file outside the folder it's meant to stay in, and under certain configurations (when a specific authentication feature, JWT, is in use) that can be turned into running the attacker's own code on the server.

Who's affected: Businesses that specifically chose to self-host their document/office suite rather than use a cloud provider's version — a deliberate, less common setup, usually chosen for data sovereignty or licensing reasons rather than stumbled into.

What to do: If you self-host ONLYOFFICE Docs, update to the latest release today (check the project's GitHub release notes) and confirm JWT authentication is properly configured rather than disabled as a workaround. If you only use ONLYOFFICE through a cloud plan, your provider handles this and there's nothing for you to do.

5. Strapi CMS — an old admin-panel flaw can expose user details, and affected versions may be out of support (CVE-2023-22894)

🛠️ Strapi · added 8 Oct 2026 · CISA fix-by date 11 Oct 2026 (1 day overdue)

What it is: Strapi is a popular "headless CMS" — backend software many small businesses and web developers use to manage website content behind a custom front end. This flaw lets someone who already has access to the admin panel pull sensitive user details that should have been hidden, through the panel's own search filter. CISA's notes flag that the affected versions may now be end-of-life, and that this bug can be chained with another (CVE-2023-22621) to take full control of the server.

Who's affected: Businesses whose website or web app was built on Strapi — ask whoever built your site if you're not sure. Riskiest where the admin panel is reachable from the open internet rather than restricted to an office network or VPN.

What to do: Confirm with your developer or IT provider which Strapi version is running. If it's an end-of-life version, the real fix is upgrading to a supported release, not a patch — and in the meantime, restrict who can reach the admin panel at all.

This is an awareness summary of public CISA KEV data, not professional security advice. CISA "fix-by" dates are US federal deadlines; for everyone else they're a strong urgency signal, not a legal obligation. Always confirm the affected versions and the fix against the vendor's own advisory.

Reading about a breach — could it happen to you?

Most of these stories start with something an attacker can see from the outside: an exposed service, a spoofable domain, weak encryption. You can check your own domain for the same things in about a minute — free, no login, nothing intrusive.

Run a free posture scan →Check your Cyber Essentials readiness

Compiled from CISA's public Known Exploited Vulnerabilities catalog. This briefing is for awareness purposes only and does not constitute professional security advice; always confirm affected versions and the fix against the vendor's own advisory.