Two Hours From Public Detail to Exploit Attempts Against Atlassian

Honeypots began catching CVE-2026-21589 traffic almost immediately after the first technical write-up landed, with scanners replaying the published proof-of-concept paths verbatim. Separately, JFrog disclosed an unauthenticated RCE in LMCache that is still unpatched and runs as root in the project’s own container images.

Vulnerabilities & Exploitation

• Atlassian CVE-2026-21589 has moved from patch to exploitation. SANS ISC saw attempts against its honeypots starting 6 October using the exact URLs from watchTowr’s write-up, e.g. /download/resources/jira.webresources:color-picker-popup/images/..::..::..::WEB-INF::web.xml — Atlassian replaces slashes with ::, and the server translates the pattern back to /, giving traversal confined to the web application directory. The target file must exist, so WEB-INF/web.xml stands in for /etc/passwd; all observed source IPs were DigitalOcean and ISC assesses a single actor (SANS ISC). The Hacker News puts the first attempts within two hours of public details on the 9.3-rated flaw, which affects eight Data Center products patched 5 October (The Hacker News, BleepingComputer). For teams still triaging, @vuln_tracker points to fixed builds Confluence 9.2.26 and Bitbucket 9.4.26 / 10.2.8 / 10.5.1, with a Tomcat RewriteValve rule as Atlassian’s stopgap. (earlier coverage)
• LMCache has an unauthenticated pickle-deserialization RCE with no fix (CVE-2026-105192, CVSS 9.8). In multiprocess/distributed mode the KV-cache layer — used alongside inference engines such as vLLM — opens a ZeroMQ ROUTER (default port 5555) with no CURVE, ZAP or message authentication; a msgpack extension registered for DeviceIPCWrapper calls pickle.loads while the server is still decoding REGISTER_KV_CACHE arguments, before any handler runs. The 9.8 applies to the documented multi-node setup where --host binds a routable address; official container images run as root. Present from v0.3.9 through v0.5.5 and the dev branch as of 7 October, with no fixed release (JFrog).
• SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace (CVE-2026-102255). It reaches internal functionality before authentication on models 6210, 7210 and 8200v; fixed in 12.4.3-03670 and 12.5.0-03082. SonicWall says it has no evidence any of the four new flaws is being exploited — but this is the third unauthenticated 10.0 SSRF in WorkPlace this year, and the July and September pairs were both investigated as exploited (The Hacker News). Appliances sitting on the 1 September fix build need the new hotfix.
• Zammad session leak to RCE gets a full chain write-up (CVE-2026-102489), from leaked session material to code execution on the helpdesk host (Horizon3).
• Flexera FlexNet Publisher has a hardcoded auth bypass in the lmadmin SOAP handler (CVE-2026-19572, CVSS 4.0 9.3) — an unauthenticated user can obtain a privileged administrator session on the license server embedded in a long tail of enterprise and engineering software (Revenera advisory).
• Cisco’s 7 October NX-OS bundle carries five CVSS 9.8 unauthenticated root RCE/DoS flaws on Nexus 3000/9000, reachable via crafted MPLS echo-requests (CVE-2026-76465), NGOAM packets to an IP interface (CVE-2026-76485/76486/76501) and NX-API HTTP requests (CVE-2026-76471, which also touches UCS 6300 Fabric Interconnects) (Cisco).

AI & Model Security

• Anthropic folded Project Glasswing into a three-tier Cyber Verification Program, with Defense Access (IR, malware RE, vuln analysis), Red Team Access (adds authorised pentest/red teaming) and Specialized Access (fewest safeguards, limited to orgs testing safety systems), across Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. On the CyScenarioBench evaluation, the Defense tier blocked 46 of 50 tasks on Opus 5.5, while Red Team Access blocked none and completed 34 of 50 — the same completion rate as with no safeguards; without CVP access every task was blocked on the first prompt. Anthropic claims at least 129,000 verified vulnerabilities between April and July 2026, over 33,000 rated critical or high, though it concedes this is survey data from a subset of partners (The Hacker News, SecurityWeek). VulnCheck’s Patrick Garrity counters that only 2 of 300 vulnerabilities attributed to Anthropic/Glasswing have seen exploitation in the wild (0.67%): Ghost CMS SQLi CVE-2026-26980 and Rejetto HFS session forgery CVE-2026-61500.
• OpenAI dumped 372 AI-generated mathematical results onto GitHub rather than into journals, many with Lean formalisations for machine checking, each consuming roughly three hours of ChatGPT Pro Thinking compute on average and nearly all produced from a single prompt to a single agent — against the 10,000-agent swarm behind its earlier Navier-Stokes result. The Decoder notes 25 Fields medallists have warned that mass-producing results risks crowding out the work that generates ideas (The Decoder, OpenAI); mathematicians’ first-hand accounts of reviewing them are collected by Scott Aaronson. (discussion)
• Claude Haiku 5.5 posts a large computer-use jump: 72.4% on OSWorld-2.1 against 15.7% for Haiku 4.5, and 39.2% on Terminal-Bench 4.0 where its predecessor scored zero. Token prices fall up to 90% for prompts under 100k tokens (Anthropic says ~90% of prior Haiku requests), with a new tokenizer consuming more tokens per task eating into the saving (The Decoder).
• Google opened its SynthID detector to the public, covering content watermarked by Google and partners including OpenAI and Nvidia — over 180 billion images and videos since 2023. It only identifies SynthID-tagged media, not AI-generated content generally (Google).

Threat Activity

• PoeLLM hides its C2 address in a poem on GitHub. Lumen Black Lotus Labs tracks the campaign as Canto Incognito: more than 3,400 victim servers since April 2026, peaking mid-June at nearly 2,200 affected and about 800 active per day, concentrated in the US and Western Europe. Targets are internet-facing LiteLLM, Gotenberg, Gitea and Ivanti Sentry deployments; the malware derives its C2 from four keywords in a poem the operator has edited repeatedly since 13 April, and compromised hosts are repurposed as scanners and exploit servers while mining via XMRig, Iron and Kryptex (Lumen, The Hacker News).
• FortiBleed now has a number attached: 86,644 harvested Fortinet device credentials across 194 countries. The FBI/USSS advisory adds that victims may find themselves locked out when operators disable accounts or change passwords, that attackers create new firewall accounts for persistence, and that access is being handed to initial-access brokers and affiliates of INC/Lynx and Payload ransomware. The operation became visible after the crew exposed its own backend server (The Record). (earlier coverage)
• BlueKit phishing-as-a-service now ships 97 brands across 176 templates. Malwarebytes has tracked the platform since it appeared on a cybercrime forum in April; alongside banking, crypto and social templates it includes pages built to steal OpenAI and Anthropic logins — a reminder that AI-service credentials are now a target set of their own (Malwarebytes).
• Threat actors are moving C2 onto smart contracts. Unit 42 traces a progression from hardcoded endpoints to Web3 contract lookups, letting an operator repoint an entire botnet or worm network with a single transaction, used in cloud supply-chain compromises (Unit 42).
• UAC-0099 / Earth Sirrush embeds ZIP payloads inside PNG images, extracted via predefined markers, with spear-phishing for access, scheduled-task persistence, C2 tasking hidden in invisible HTML footer elements, sandbox checks and hybrid AES-RSA C2 encryption (technical brief).
• Dread and Omega migrated after an alleged GoBalance key-recovery flaw. Dread’s admin claims the Tor load balancer treated 64-byte Ed25519 private keys as 32-byte, dropping secret key material during descriptor signing and making the onion service master key recoverable from a published descriptor — affecting all released versions, with Omega’s main link redirecting to an attacker-run service. These are operator claims, not independent analysis (Dark Web Informer).

Detection & Purple Team

• Nextron expanded THOR coverage for the Citrix NetScaler exploitation to 21 new rules, spanning CVE-2026-88771 exploitation and encoded variants, webshell droppers and encoded payloads, Perl bind shells, hidden payload downloads, suspicious chmod on /bin/sh, EPA bypass and authentication-policy manipulation, and privileged user creation (Nextron). (earlier coverage)
• Console Named Pipe injection gets a detection strategy and lab PoC. The technique writes shellcode to a child console process (netsh.exe, nslookup.exe) through its STDIN pipe via WriteFile from the parent, avoiding VirtualAllocEx, WriteProcessMemory and CreateRemoteThread entirely; detection leans on anomalous parent-child pairs (Sysmon EID 1) plus pipe create/connect events (EID 17/18) (@ipurple).

New Tools & Releases

• Invisible Playwright MCP — a Playwright MCP server driving an anti-detect stealth Firefox so agents can browse without tripping anti-bot and captcha defences; installs as a Claude or Codex plugin or Gemini extension, supports HTTP/SOCKS proxies and defaults to GLM-5.3-flash via OpenRouter (GitHub).
• DiagNG — P1 Security’s successor to QCSuper, a fresh open-source effort to open up mobile baseband Diag protocols for capture and analysis (P1 Security).
• AWS open-sourced an agent sandbox aimed at containing autonomous agents running in “YOLO mode” before they touch production (The Register).

Cloud & Identity

• A retired server with a public Metabase instance cost Discord security bot Double Counter ~28M user records. The attacker forged an administrator session in the analytics tool still running on an unused OVH host, then used two legitimate credentials found there — a service-account key with administrator rights and an admin’s saved CLI session — to pivot into cloud infrastructure for nearly six hours. Roughly 12 GB came out of one database: ~28M Discord user IDs/usernames, ~27M IP and coarse-location records and ~1M email addresses, plus bot-token abuse to post attacker links in about 50 large servers and $7,316 in fraudulent charges. CNIL was notified (Double Counter).
• ASOS confirmed a breach after attackers pushed rogue notifications to its app, via a compromised third-party communication platform; the retailer says customer personal information may have been accessed (SecurityWeek). (earlier coverage) (discussion)

Arrests & Enforcement

• The detained ShinyHunters leader was mid-extortion of a Boeing spin-off when arrested. Krebs identifies “Rey” as Saif Al-din Khader of Amman, detained while the group was extorting Jeppesen ForeFlight, and reports he is cooperating with the FBI; the group’s access route remains mass exploitation of PeopleSoft flaw CVE-2026-35273, used as a zero-day from June (KrebsOnSecurity). Denmark’s CERT notes the FBI has confirmed further arrests in the case (CERT.dk). (earlier coverage) (discussion)
• MonsterCloud’s owner was charged over a $19M ransomware-remediation fraud. Prosecutors allege Zohar Pinhasi told victims his firm recovered data with proprietary technology while secretly negotiating with and paying the attackers, then billing clients substantially more (DOJ, BleepingComputer).
• The State Department posted a $10M reward for Zhang Yu, described as a prominent figure in the Hafnium campaign and accused of MSS-directed espionage against COVID-19 research at US universities (The Record).

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .