Qilin, SafePay, Everest, Akira, The Gentlemen, SilentRansomGroup, WallStreet, Incransom, Panzer and Storm all hit their maximum observed activity on the same calendar day: 19, 19, 13, 10, 39, 6, 5, 5, 4 and 7 items respectively, 193 of the 389 event-timed items in a four-day window, against 51 on 5 October and 88 on 7 October. Seven of the ten had a median of zero on every other day, which is to say they did not exist in these feeds until Tuesday and then existed quite a lot. We cannot tell you yet whether that is a coordinated dump-day on a forum nobody has shown us, or a pipeline catching its breath and exhaling four days of posts at once. Both hypotheses are in the hidden section with the tests that would kill them. The timing is the part worth your coffee. NVD published 102 items into this window and then went silent through the two busiest days in it, which is when Atlassian warned that CVE-2026-21589 lets an attacker with no login read specific files in eight Data Center products, Jira, Confluence, Bitbucket, Bamboo and Crowd among them. If your patch triage is a pipe with a national feed at one end of it, Tuesday was a day you spent reading Monday. This is the uncomfortable true version: your vulnerability management programme is not a process, it is a supply chain, and yesterday one of its suppliers took the afternoon off without telling you. The attackers did not need to know that. They just needed it to be Tuesday.
Scottg
ninjalabz.io
ninjalabz.io/daily
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center. This BASM (Broken Authentication & Session Management) vulnerability, with a CVSS Score of 8.8, allows an unauthenticated attacker to perform actions as another user. Atlassian recommends that Crowd Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Crowd Data Center 7.2: Upgrade to a release greater than or equal to 7.2.2 See the release notes (https://confluence.atlassian.com/crowd/crowd-release-notes-199094.html). You can download the latest version of Crowd Data Center from the download center (https://www.atlassian.com/software/crowd/download-archive). This vulnerability was reported via our Penetration Testing program.