APT40 has jumped on these flaws days or even hours within public release, warned a new advisory by CISA, the Australian government and others.