THE weekly recap from 12 October 2026 highlights a stretch where attackers moved rapidly on newly disclosed flaws, underscoring how speed without adequate context can outpace defenders. The standout is Atlassian Data Center’s arbitrary file access flaw, CVE-2026-21589, which attackers have begun exploiting in the wild and which affects multiple products including Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, and Crowd Data Center.
Activity in the wild reportedly began just two hours after watchTowr published additional technical details. The report also notes a high-severity NVIDIA DCGM Exporter flaw, CVE-2026-47483 (CVSS 8.2), that can allow unauthenticated users to flood profiling endpoints and crash the service; Lava Security found around 2,100 publicly exposed hosts across ~300 organisations, with GPUs valued at about $100 million, and says the issue is fixed in version 4.8.2 and later.
In other big-name news, three arrests linked to the ShinyHunters gang were reported, including a third arrest in Jordan connected to the group’s suspected activities on the FBIjobs[.]gov breach, with Edward Dubrovsky named by press reports as a principal figure.
Other notable developments include threat actors hijacking country-code TLS certificates for .gh, .sl, and .as domains to obtain Google certificates, prompting Chrome to block them via CRLSets; two Zammad zero-days (CVE-2026-102489 and CVE-2026-102490) tied to the Dutch Institute for Vulnerability Disclosure breach were added to the KEV catalog, requiring federal remediation by 5 October 2026.
The recap also references ongoing activity around Akira ransomware via RDP access, the MATCHBOIL downloader campaign by UAC-0099, and broader concerns about AI-enabled manipulation, including OpenAI's disruption of two influence operations linked to Russia and Iran.