The old software still working behind a business’s new website

CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog on October 8, 2026: flaws in BIND, Apache Struts, Strapi, ONLYOFFICE Docs and ProFTPD. Their CVE identifiers date from 2015 to 2023. Inclusion means CISA has evidence of exploitation; it does not mean five vulnerabilities were discovered that morning.

CISA’s official October 8 catalog revision

That distinction matters when the product names sound unfamiliar. These programs often provide a function people recognize without showing their own names: finding a website, serving an account page, editing a document or receiving a file. A business can depend on one without an employee opening an application bearing its logo.

BIND: the address book behind your connections

BIND is DNS server software. DNS translates names people use into the network addresses computers need. It can provide answers about a company’s own domain or help its devices look up other destinations. ISC, BIND’s developer, describes deployments ranging from hosting companies to businesses running internal and external DNS.

ISC explains BIND’s role in DNS

CVE-2015-5477 can make a vulnerable BIND server stop running. That is a denial of service: disrupting availability, rather than establishing that information was stolen. ISC’s advisory covers both servers publishing DNS information and those looking it up for clients, and directs operators to patched software.

ISC’s advisory for CVE-2015-5477

For a business, this suggests looking beyond the machine hosting its website. An older DNS server might support office systems or sit within a hosting arrangement inherited from a previous supplier. If name lookups fail, a functioning application can appear unreachable. The business consequence depends on what relies on that DNS service and whether an effective alternative exists.

Apache Struts: the machinery behind a web application

Struts is a framework for building Java web applications. A framework supplies reusable structure that developers build upon; the finished application may carry an entirely different product name. Apache also warns that unsupported Struts versions no longer receive security fixes.

Apache Struts project and support guidance

CVE-2016-3081 can allow code to run on the server when a feature called Dynamic Method Invocation is enabled. This means an attacker may cause the server to carry out instructions, a more serious possibility than simply interrupting a page. Apache’s advisory identifies the affected releases and the feature requirement.

Apache’s S2-032 security advisory

An older ordering portal or internal business application is the kind of place we would ask its developer to check. Those are examples, not claims about a specific affected business. A redesigned homepage would tell you little about the framework still serving account pages behind it. Ask about the application’s components, not whether the website looks current.

Strapi: the content system behind the page

Strapi manages content and supplies it to websites or applications through software interfaces called APIs. Editors can work in its administration screen while visitors see a separate website. This separation is often called a headless content management system: the content service and the public presentation can be maintained separately.

Strapi’s description of its content platform

CVE-2023-22894 can expose sensitive user information through filtering on fields that should remain private. Strapi’s disclosure explains that researchers also found a route involving a separate vulnerability that could lead to server code execution. Its timeline records a fix on March 15, 2023 and disclosure on April 17, 2023.

Strapi’s vulnerability disclosure and historical timeline

The practical question is whether a content service survived a website migration. A team might replace its public pages while retaining the original editing system, or leave a previous test deployment running. Neither situation proves vulnerability. Both explain why checking only the software visible to a visitor could miss the component that needs attention.

ONLYOFFICE: the editor inside another service

ONLYOFFICE Docs provides online editors and viewers for documents, spreadsheets, presentations and other files, including collaborative editing. A user can encounter that editing capability as part of their normal document workflow rather than think of the document server as a separate system to maintain.

ONLYOFFICE’s official DocumentServer project

CISA describes CVE-2021-3199 as a path-traversal flaw that can lead to remote code execution in deployments using JWT authentication tokens. Path traversal means file handling can reach outside its intended location. ONLYOFFICE’s historical release notes list the relevant image-upload fix under version 5.6.3.

CISA’s ONLYOFFICE entry

ONLYOFFICE’s historical 5.6.3 release notes

Check the server providing document editing, including any separate deployment connected to a file-sharing service. Updating a desktop office application would not establish that this server was repaired. Historical fixed versions help identify the issue; they are not a recommendation to install an obsolete release today.

ProFTPD: a file-transfer service that may outlive its original job

ProFTPD is an FTP server, used to receive and provide files over a network. Debian’s May 19, 2015 advisory describes CVE-2015-3306 in its optional file-copy module: unauthenticated users could copy files around the server, with possible code execution. The advisory supplied corrected Debian packages at the time.

Debian’s ProFTPD security advisory

Think of an upload account once used by a web agency or an automated supplier exchange. If that arrangement ended, the service might have no remaining business purpose. Removing an unused service can be a better long-term decision than continuing to maintain it. First confirm who still depends on it, so a security cleanup does not quietly break an overnight delivery.

Choose urgency from the actual deployment

The catalog addition date does not identify the beginning of every attack. Nor does a familiar product name establish that your installation is affected. Compare the installed build and relevant configuration with the vendor’s guidance. For software supplied inside another product, get the answer from that product’s supplier rather than assume the upstream version number tells the whole story.

We would give immediate attention to an affected service reachable from untrusted networks, especially one holding customer information or supporting essential operations. An internal service still needs review, but its reachable users, connections and role may change the containment choices. Exposure is one consideration; losing the only DNS service for an office could also be highly disruptive.

Support matters just as much as age. An update that fixed one issue years ago may leave other known problems untouched. Choose a currently supported upgrade path, and plan the service interruption or migration it requires. Where software is unused, retirement may be simpler. Where it is essential but unsupported, treating replacement as optional maintenance leaves the same problem waiting for the next advisory.

Source check: October 8, 2026. This article uses CISA’s catalog and the linked vendor documentation. Short Circuit LLC did not discover these flaws or independently verify exploitation incidents. Suggested places to check are illustrative; applicability depends on the actual installation. Historical fixes are context, not current deployment recommendations.