October 8, 2026
Two Hours From Public Detail to Exploit Attempts Against Atlassian
CVE-2026-21589 in Atlassian Data Center products moved to active exploitation within two hours of public PoC release, with honeypots catching scanner traffic replaying exact traversal URLs. LMCache carries an unauthenticated pickle-deserialization RCE (CVE-2026-105192, CVSS 9.8) in multiprocess mode with no fix available, running as root in official containers. FortiBleed credential harvesting reached 86,644 Fortinet device credentials across 194 countries, with access being distributed to initial-access brokers and ransomware affiliates including INC and Lynx. Threat actors are moving C2 infrastructure onto blockchain smart contracts to enable rapid botnet repointing, while UAC-0099 / Earth Sirrush uses steganographic PNG images to hide ZIP payloads in spear-phishing campaigns.