October 11, 2026 weekly
Two Hours From Write-Up to Exploit — and the "Fixed" Build Wasn't Fixed
Atlassian pre-auth file read CVE-2026-21589 was exploited within two hours of public write-up, with attackers using exact traversal paths from the disclosure; the vulnerability exposes plaintext Crowd credentials when Jira is integrated with Crowd. Citrix NetScaler suffered its third SAML-based RCE in consecutive weeks, with CVE-2026-88779 now on CISA's KEV and CVE-2026-107406 (CVSS 9.5) following on the same code path. AhsayCBS version 10.3.4, officially listed as the patched version, remains exploitable to auth-bypass and command injection, with webshells and XMRig already deployed in the wild. The Shai-Hulud/ChainDrop worm compromised the tensorlake npm package to harvest AWS, Kubernetes, Vault, and CI secrets plus MCP and agent config files for Claude, Cursor, Kiro, Windsurf, and Zed from AI infrastructure.