Run an FTP server with ProFTPD? Patch it now

Week of 12 to 18 October 2026

This week's catch-up: four vulnerabilities that vendors fixed years ago have only now been added to the US government's must-patch list, a sign that forgotten, unpatched installs are still being found and attacked. The most urgent: an unauthenticated flaw in ProFTPD, free file-transfer server software, lets an attacker read or write any file on the server. A self-hosted ONLYOFFICE document server, an old custom web application built on Apache Struts, and a website running the Strapi content management system round out the week. If none of those names mean anything to you, nothing here applies to you.

1. 1

   Run an FTP server with ProFTPD? Patch it now8 Oct

   Businesses that run their own ProFTPD file-transfer server, typically version 1.3.5, set up by an IT provider or an in-house system administrator rather than something that comes pre-installed. If your business exchanges files through a cloud service like Dropbox or SharePoint, or a dedicated SFTP provider, this isn't your equipment.

   ProFTPD is free software some businesses run themselves to accept file uploads or send files back and forth with suppliers and customers over FTP (File Transfer Protocol), instead of paying for a managed file-transfer service. A flaw in one of its add-ons lets anyone connect without logging in at all and tell the server to copy any file to anywhere else on the system, which an attacker can use to read sensitive files or plant one that hands them full control. ProFTPD fixed this back in 2015, but the US government has only now confirmed criminals are actively exploiting it, a sign that old, forgotten installs are still being found on the internet.

   Do this

   Ask whoever manages your file-transfer server: "Are we running ProFTPD, and has it been updated to version 1.3.5a or later?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: ProFTPD flaw ↗ · Debian Security Tracker: CVE-2015-3306 ↗CVE-2015-3306 · CWE-284

2. 2

   Self-host ONLYOFFICE Docs instead of Microsoft 365? Patch it now8 Oct

   Businesses that specifically chose to self-host ONLYOFFICE Docs (Document Server) rather than use Microsoft 365 or Google Workspace, running a version older than 5.6.3. If the name doesn't ring a bell, you're not running it.

   ONLYOFFICE Docs is software some businesses install on their own server to edit Word, Excel and PowerPoint-style documents, usually chosen instead of Microsoft 365 or Google Workspace for data-control or cost reasons. A flaw in how it handles image uploads lets an attacker slip outside the folder they're meant to use and plant a file that runs their own code on the server, putting every document stored there at risk. ONLYOFFICE fixed the flaw in 2021, but it has only now been confirmed under active attack, suggesting old, un-upgraded installs are still being targeted. If your documents live in Microsoft 365 or Google Workspace, this is not your software.

   Do this

   Ask whoever manages your document server: "Are we running ONLYOFFICE Docs, and has it been updated past version 5.6.3?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: ONLYOFFICE Docs flaw ↗ · HKCERT bulletin: ONLYOFFICE Docs RCE ↗CVE-2021-3199 · CWE-22

3. 3

   Run a custom web app built on old Apache Struts? Patch it now8 Oct

   Businesses running a custom-built web application on Apache Struts versions 2.3.19 through 2.3.28, usually built by a developer or agency years ago and left running since. If you don't have a custom-built web application, this is a question for whoever would know if you did.

   Apache Struts is a framework developers use to build custom Java-based web applications, things like an internal staff portal or a system built specifically for one business rather than bought off the shelf. In older Struts versions with a feature called Dynamic Method Invocation turned on, an attacker can send a specially crafted request that runs their own code on the server, no login required. Apache fixed this back in 2016, but the US government has only now confirmed criminals are actively exploiting it, a sign that old, never-upgraded custom applications are still out there.

   Do this

   Ask your developer or IT provider: "Does our application use Apache Struts, is Dynamic Method Invocation turned on, and has it been updated past version 2.3.28.1?"

   Essential Eight: Patch applicationsISM: Web application security

   Sources: CISA KEV: Apache Struts flaw ↗ · Apache Struts advisory S2-032 ↗CVE-2016-3081 · CWE-77

4. 4

   Run your website on the Strapi CMS? Update it now8 Oct

   Businesses whose website or web app was custom-built on Strapi, usually set up by a web developer or agency rather than something you'd recognise yourself. If your website runs on WordPress, Shopify, Squarespace or a similar off-the-shelf platform, this isn't yours.

   Strapi is free, open-source software, a content management system developers use to build the backend of custom websites and apps instead of something like WordPress. A flaw lets an attacker who isn't logged in trick the admin panel into leaking the code needed to reset a Strapi administrator's password, letting them take over the admin account entirely; chained with a second flaw, that can go all the way to running commands on the server. Strapi fixed it in version 4.8.0, released in 2022, but the US government has only now confirmed it is under active attack, a sign that sites still running old versions are being found and targeted.

   Do this

   Ask your web developer or agency: "Is our site running Strapi, and has it been updated past version 4.8.0?"

   Essential Eight: Patch applicationsISM: Web application security

   Sources: CISA KEV: Strapi flaw ↗ · GitHub Security Advisory GHSA-jjqf-j4w7-92w8 ↗CVE-2023-22894 · CWE-312

Latest ISM release: ISM September 2026: What Changed and What to Check →What the ISM is and how we assess it →