A flaw that was patched six months ago is still being used by hackers aligned with Russia and China, among others.