Skip to main content

ARE Global Consulting LLC

MenuClose

Patch Check for Small Defense Contractors

Updated October 10, 2026.

On October 8, 2026, the U.S. Department of Justice and FBI announced court-authorized seizures of two tools, “Microscan” and “FishHub.” According to DOJ, court documents unsealed in the Western District of Pennsylvania allege that actors working for Integrity Technology Group, a company based in the People’s Republic of China, operated and used the tools. Those are allegations. The same day, CISA, the FBI, NSA and international partners published joint advisory AA26-281A, which describes Integrity Technology Group-enabled activity and recommends mitigations.

CISA also added five vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on October 8. Federal civilian agencies were directed to remediate by October 11, 2026:

  • ProFTPD – CVE-2015-3306
  • ISC BIND – CVE-2015-5477
  • Apache Struts – CVE-2016-3081
  • ONLYOFFICE Docs – CVE-2021-3199
  • Strapi – CVE-2023-22894 (CISA notes the product may be end-of-life or end-of-service)

A practical five-point check

  1. Inventory: do any servers, appliances or web applications you own or host run the products above, including older systems no one has reviewed recently?
  2. Patch or retire: apply vendor fixes, or move off unsupported versions.
  3. Reduce exposure: disable unused services and ports; sanitize web application inputs.
  4. Require multifactor authentication on all services, including email.
  5. Review logs for the indicators of compromise listed in AA26-281A, and record what you checked and when.

Why this matters for NIST SP 800-171 work. Flaw remediation, configuration management, and access control are routine parts of a 800-171 security program, and a documented patch review is useful evidence of them. DoD suspended CMMC Phase 2 on July 13, 2026; the suspension does not change the underlying value of maintaining these practices. Contractors should confirm the requirements in their own contracts.

ARE Global Consulting is an independent advisory firm. We can help you structure an inventory-and-patch review and document it. alfonso.evans@areglobalconsulting.com · 218-693-2958

Sources: DOJ, Oct. 8, 2026 · CISA AA26-281A · CISA KEV catalog · DoD CMMC Phase II suspension. ARE Global Consulting LLC is independent and has no government affiliation. This note is general information, not legal advice.