The Exploit Bulletin — Friday, October 9, 2026: 3 issues require action
Friday, October 9, 2026 — 3 issues require action. If you run none of the software below, you are done.
Affects: ProFTPD · ONLYOFFICE Docs / Document Server · Bricksforge WordPress plugin
1. Unauthenticated file copy via mod_copy SITE CPFR/CPTO in ProFTPD gives remote code execution (CVE-2015-3306)
CISA KEV (due 2026-10-11) · REMOTE CODE EXECUTION · CRITICAL · CVSS 10.0
CISA added this flaw to KEV on 2026-10-08 with a remediation deadline of 2026-10-11, released alongside joint advisory AA26-281A on Chinese government-linked actors, so an internet-facing ProFTPD still running the vulnerable 1.3.5 build with mod_copy loaded should be treated as a known target and fixed now.
ProFTPD's mod_copy module accepts SITE CPFR and SITE CPTO commands from any client before authentication, letting an attacker copy files from anywhere on the filesystem to a destination of their choosing. Copying attacker-controlled content into a web root or other executed location yields remote command execution, and a Metasploit module automates the attack against ProFTPD 1.3.5.
Affected: ProFTPD 1.3.5 with the mod_copy module enabled (per the Metasploit module description)
How to Test: Check the installed ProFTPD version and whether the mod_copy module is loaded; if a plain FTP client can issue SITE CPFR / SITE CPTO before logging in and the server accepts them, the host is exposed. Review FTP logs for SITE CPFR and SITE CPTO commands from unauthenticated or unexpected sessions, and look for unexpected new files in web roots, cron directories, or other writable locations reachable by the FTP process, which indicate a successful copy.
How to Patch: Install your distribution's fixed proftpd packages (Debian DSA-3263; the openSUSE and Fedora updates referenced in the advisory list) or upgrade off ProFTPD 1.3.5 to a release where the mod_copy fix is included. If an upgrade must wait, unload or disable the mod_copy module so SITE CPFR/CPTO are no longer served, and restrict FTP exposure to trusted networks.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA AA26-281A (2026-10-08), cited by VulnCheck KEV as exploitation source · Exploit-DB 36803 — ProFTPD 1.3.5 mod_copy command execution
2. Image-upload path traversal in ONLYOFFICE Docs allows unauthenticated remote code execution (CVE-2021-3199)
CISA KEV (due 2026-10-11) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
CISA added this 2021 flaw to KEV on 2026-10-08 in connection with advisory AA26-281A on Chinese government-linked actors, with a 2026-10-11 remediation deadline; teams running an old Document Server exposed to the internet should assume it is being scanned for and patch or isolate it now.
A /.. sequence in an image upload parameter lets an unauthenticated attacker write files outside the intended directory on an ONLYOFFICE Document Server, which can be leveraged for remote code execution. Public proof-of-concept scripts targeting the image upload endpoint exist on GitHub.
Affected: ONLYOFFICE Docs / Document Server releases prior to the fix recorded in the 5.6.3 changelog entry
How to Test: Record the Document Server version on each host and compare it against the 5.6.3 changelog entry referenced for this fix; anything older is affected. Review web server and Document Server logs for image upload requests whose parameters contain /.. traversal sequences, and check for unexpected files written outside the upload directory; treat such artifacts on an unpatched server as a possible compromise.
How to Patch: Upgrade ONLYOFFICE Docs / Document Server to a release at or beyond the 5.6.3 changelog fix (preferably the current supported version). Until upgraded, restrict network access to the Document Server so that only trusted integrations can reach its upload endpoints.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · CISA advisory AA26-281A (2026-10-08)
3. Unauthenticated arbitrary file upload via temporaryFileUploads in Bricksforge WordPress plugin leads to RCE (CVE-2026-85097)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.8
Patchstack published on 2026-10-08 that this flaw is being exploited and VulnCheck added it to its known-exploited catalog on 2026-10-07; sites still on 3.1.8.9 or earlier are exposed to a no-login webshell drop.
Bricksforge, a Bricks Builder add-on for WordPress, lets an unauthenticated attacker fetch a valid nonce from the bricksforge_regenerate_nonce AJAX endpoint, upload a GIF/PHP polyglot to the temporary upload directory, and then submit a form with a crafted 'temporaryFileUploads' parameter to move the file into a web-reachable location. The result is arbitrary PHP execution on the site with no credentials required.
Affected: Bricksforge WordPress plugin <= 3.1.8.9
How to Test: In WordPress Plugins, confirm the installed Bricksforge version; anything at or below 3.1.8.9 is vulnerable. Review web server logs for unauthenticated requests to admin-ajax.php with action bricksforge_regenerate_nonce followed by form submissions carrying a 'temporaryFileUploads' parameter, and inspect the plugin's temporary upload directory and wp-content/uploads for files with GIF headers containing PHP code or unexpected .php files.
How to Patch: Update Bricksforge to the latest release newer than 3.1.8.9 published in the vendor changelog (bricksforge.io/version-changelog/). If you cannot update immediately, deactivate the plugin or block unauthenticated access to the bricksforge_regenerate_nonce AJAX action and the form submission endpoint at the WAF; Patchstack states it has deployed a mitigation rule for its customers.
Evidence: VulnCheck KEV · Patchstack: Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin (2026-10-08)
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
