Published: 10/07/26
Wednesday’s clock starts on the tools your developers live in. Atlassian disclosed a critical unauthenticated file-read across eight Data Center products on Sunday, and self-hosted Confluence, Jira and Bitbucket still need the fixed builds. Also on the desk: a Struts OGNL path that only bites the legacy REST mapper, a Smarty cache-marker bug under a lot of PHP apps, and Osaka Metropolitan University’s ransomware outage that cancelled classes into Thursday. Reminder from Monday’s brief: the NetScaler SAML KEV due date is today, Wednesday October 7 — confirm Sunday’s builds are actually installed.
Lead Story
Your Confluence and Jira boxes can leak known files without a login — patch Data Center today
CVE-2026-21589 lets an unauthenticated attacker read specific files from the web application root on Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center. Atlassian scored it 9.3. Cloud is patched. Take internet-facing instances offline or apply the temporary WAF rule until you hit the fixed builds.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Source, wiki, tickets and identity on one unauthenticated read path. “They need to know the filename” is not a control.
Also Worth Your Attention
If your Java app still uses Struts’ old REST mapper, upgrade before someone tests it
S2-075 / CVE-2026-104711 is OGNL injection that can reach remote code execution when the legacy RESTful action mapper is configured. Default and restful2 mappers are fine. Move to Struts 6.12.0 or 7.4.0.
Why it matters: The risky mapper lives in apps nobody has opened since 2018.
The PHP template engine under your storefront needs a quiet update
Smarty CVE-2026-82531 lets forged cache markers inject PHP when caching and unescaped output line up. Fixed in 4.5.8 / 5.8.5. Clear the template cache after you update, and ask vendors who embed Smarty for their bump.
Why it matters: Millions of installs, most of them transitive.
Osaka’s university lost hundreds of servers to ransomware — classes stay cancelled through Thursday
OMU reports a suspected ransomware hit that took down roughly 500 servers and may touch data for about 130,000 people. Theft not confirmed. In-person classes planned to resume Friday. Hospital EMR stayed up.
Why it matters: When virtualization and backups share a fate, “we have backups” is a wish.
Wednesday brief — patch Atlassian Data Center for CVE-2026-21589 (unauth file read, 8 products; cloud already fixed). Struts S2-075: upgrade to 6.12.0/7.4.0 if legacy REST mapper is on. Smarty to 4.5.8/5.8.5 then clear caches. OMU ransomware: ~500 servers, classes through Thu — prove offline restores. Reminder: NetScaler SAML KEV due TODAY (Wed Oct 7).
Go Deeper
Identity & Access Management → · Cybersecurity Tools →
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
