October 9, 2026
- Atlassian CVE-2026-21589 exploitation now has numbers: Previdian honeypots logged 190 attempts from 32 IP addresses in 10 countries as of 8 October, starting hours after watchTowr's PoC on 6 October; CISA has not added it to KEV. The dangerous path is Jira integrated with Crowd, where the readable config file holds plaintext Crowd application credentials (SecurityWeek). @vuln_tracker notes the fixed builds are Confluence 9.2.26 and Bitbucket 9.4.26 / 10.2.8 / 10.5.1, with a Tomcat RewriteValve rule as a stopgap (earlier coverage).
· Vulnerabilities & Exploitation
- Pwn2Own Ireland 2026 paid $388,500 for 32 zero-days on day one (ZeroHack) and $232,500 for 45 unique zero-days on day two, with the Samsung Galaxy S26 falling three more times (BleepingComputer) (earlier coverage).
· Vulnerabilities & Exploitation
- CrowdStrike named the tooling behind the South Korean bank intrusions: ARTEX, a recently released Chinese open-source LLM multi-agent pentest framework, running DeepSeek v4.1-flash as its main backend with Z.ai GLM-5.3 and Grok 4.6 supplementing. The campaign was found through open directories on a Hong Kong IP (
38.244.50[.]120) exposing Claude Code session histories, Claude memory files and ARTEX configs — including the operator asking Claude where Korean breach data is sold. Active late September to early October 2026, unattributed but assessed as a financially motivated Chinese-speaking operator; more than 25,000 customer records were taken from Shinhan Bank alone, and ARTEX has since gone closed source (The Hacker News, The Decoder) (earlier coverage).
· AI & Model Security
in Third NetScaler RCE in a Month Lands on the Same SAML Surface
October 8, 2026
- Atlassian CVE-2026-21589 has moved from patch to exploitation. SANS ISC saw attempts against its honeypots starting 6 October using the exact URLs from watchTowr's write-up, e.g.
/download/resources/jira.webresources:color-picker-popup/images/..::..::..::WEB-INF::web.xml — Atlassian replaces slashes with ::, and the server translates the pattern back to /, giving traversal confined to the web application directory. The target file must exist, so WEB-INF/web.xml stands in for /etc/passwd; all observed source IPs were DigitalOcean and ISC assesses a single actor (SANS ISC). The Hacker News puts the first attempts within two hours of public details on the 9.3-rated flaw, which affects eight Data Center products patched 5 October (The Hacker News, BleepingComputer). For teams still triaging, @vuln_tracker points to fixed builds Confluence 9.2.26 and Bitbucket 9.4.26 / 10.2.8 / 10.5.1, with a Tomcat RewriteValve rule as Atlassian's stopgap. (earlier coverage)
· Vulnerabilities & Exploitation - FortiBleed now has a number attached: 86,644 harvested Fortinet device credentials across 194 countries. The FBI/USSS advisory adds that victims may find themselves locked out when operators disable accounts or change passwords, that attackers create new firewall accounts for persistence, and that access is being handed to initial-access brokers and affiliates of INC/Lynx and Payload ransomware. The operation became visible after the crew exposed its own backend server (The Record). (earlier coverage)
· Threat Activity
- ASOS confirmed a breach after attackers pushed rogue notifications to its app, via a compromised third-party communication platform; the retailer says customer personal information may have been accessed (SecurityWeek). (earlier coverage) (discussion)
· Cloud & Identity
in Two Hours From Public Detail to Exploit Attempts Against Atlassian
October 7, 2026
- Atlassian disclosed CVE-2026-21589 on October 5, a CVSS 4.0 9.3 unauthenticated arbitrary file access flaw in Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible and Fisheye (Data Center/Server). The attacker must know the exact path and filename — directory listing is not possible — but the read is pre-auth and scoped to the web app root. watchTowr Labs published an analysis and Horizon3 shipped detection; no exploitation has been reported (The Hacker News). @vuln_tracker notes Atlassian lists a Tomcat RewriteValve rule as a stopgap for Confluence, Jira, JSM, Bamboo and Crowd.
· Vulnerabilities & Exploits
in Pre-Auth File Read Hits Eight Atlassian Data Center Products
August 11, 2026
- Atlassian Rovo can be hijacked by hidden text in a PDF, a second route separate from last week's "RovoBlast." PromptArmor showed instructions buried in an uploaded file silently exfiltrating Jira and Confluence data with no user confirmation and no trace (The Decoder); THN notes two firms found the behavior independently and only one route is confirmed closed (The Hacker News, earlier coverage).
· AI & Model Security
in Metabase Zero-Day Blast Radius Widens to LexisNexis and Framework
August 8, 2026
in OpenAI Pauses Its Astra Model After It Hits the "Critical" Cyber Threshold