TODAY
Old, well-known flaws in Struts and ProFTPD are being actively exploited again
THE THREE
- KEV#1 · CVE-2016-3081
Apache
What: Attackers can run their own commands on servers running old Apache Struts versions with a certain feature enabled. That can lead to a full server takeover. It was added to CISA's exploited list 7 days ago, and the exploit odds are 96%.
Why it moved: Actively exploited · Everyone runs this · 96% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Find Struts apps, upgrade them, and disable Dynamic Method Invocation.
- KEV#2 · CVE-2026-85706
Gitlab
What: Anyone on the internet can read arbitrary files on an unpatched GitLab server without logging in. Those files can include source code and stored secrets. It is rated 10.0 and has been actively exploited since CISA listed it 34 days ago.
Why it moved: Actively exploited · Widely deployed · Critical severity · 93% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Patch GitLab to the fixed version and rotate any exposed secrets.
- KEV#3 · CVE-2026-20079
Cisco
What: An attacker can skip the login on Cisco's firewall management console without any credentials. That hands them control over the tool that manages your firewalls. It is rated 10.0, and CISA listed it as exploited 36 days ago.
Why it moved: Actively exploited · Widely deployed · Critical severity · 88% exploit odds
Who is exploiting: Actively-exploited (CISA KEV)
Action · Apply Cisco's fix and restrict FMC access to trusted admin networks.
TRAVERSAL
No cross-feed connection surfaced in today's graph. That's the honest reading — we don't invent one.
NUMBERS
- Entities
- 12M
- Relationships
- 67M
- Threat actors
- 246
- Indicators
- 989k
- Feeds live
- 20
- Sources total
- 24
Get tomorrow's brief in your inbox
07:15 UK. One email. One link. Nothing else.
Daily · one email · unsubscribe in one click · UK GDPR double opt-in.