Cyber Pulse · Week 41 · 5–11 Oct 2026
This week in 60 seconds
- Newly disclosed flaws in two products were exploited this week. One is in self-managed Atlassian Data Center products: attacks began within hours of technical details going public on 6 October. The other is in the AhsayCBS backup server that many MSPs run, where Ahsay says its first fix did not fully work.
- Two fixes changed. FortiMail now has fixed builds (Fortinet, 5 October). Citrix’s 8 October SAML bulletin means a NetScaler acting as a SAML identity provider has to be upgraded again, past the Week 40 builds.
- No UAE or GCC incident is confirmed in this week’s sources. That reflects what our sources covered, not proof that the region was quiet. One Saudi claim reported by The National is listed below as unconfirmed.
Patch now
| Severity | CVE | Product | Exploited? | Action |
|---|---|---|---|---|
| CRIT | CVE-2026-21589 | Atlassian Data Center: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible, Fisheye (self-managed only; Cloud is already fixed) | Yes (attempts in the wild seen by Previdian and watchTowr; not in KEV) | Upgrade to a fixed release: Jira 9.12.40 / 10.3.26 / 11.3.12; Jira Service Management 5.12.40 / 10.3.26 / 11.3.12; Confluence 9.2.26 / 10.2.19; Bitbucket 9.4.26 / 10.2.8 / 10.5.1; Bamboo 10.2.24 / 12.1.12; Crowd 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible and Fisheye 4.9.15. Until then, take the instance off the internet or apply Atlassian’s WAF or RewriteValve rule. Search access logs (decoded up to twice) for .. next to /, \ or ::. |
| CRIT | CVE-2026-105133 + CVE-2026-105134 | AhsayCBS backup server v10, including 10.3.4.0 | Yes (Huntress: from 7 Oct, web shells and cryptominers) | Apply hotfix 10.3.4.45 from the Ahsay partner portal and reboot. Ahsay says 10.3.4.0 did not fully fix either flaw. Restrict the management interface to trusted IPs or VPN. Hunt for commands spawned by cbssvcX64.exe, JSP web shells in the CBS web directory, edge.exe or msedge.exe in Temp folders, and a MicrosoftEdgeUpdateSvc service that launches them. |
| CRIT | CVE-2026-104286 | Fortinet FortiMail with IBE (update from Week 40) | Yes (Fortinet, KEV) | Fixed builds are now listed: upgrade to 8.0.2, 7.6.7 or 7.4.9. Branch 7.2 must move to 7.4 or later. FortiMail Cloud is already fixed. Keep IBE disabled until the upgrade is done, and hunt for the FG-IR-26-175 indicators, including an unexpected remote archive account such as archive234. |
| CRIT | CVE-2026-107406 | Citrix NetScaler ADC/Gateway configured as a SAML IdP or SP | No (Citrix knew of no exploits at publication on 8 Oct; it is listed here because this product family is under active attack) | Upgrade to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1.37.283 (FIPS/NDcPP). If the appliance is a SAML IdP (add authentication samlIdPProfile), the Week 40 builds 14.1-73.41 and 13.1-64.28 are still affected. Builds older than the Week 39 fixes are affected as SP or IdP. |
| HIGH | CVE-2015-3306, CVE-2021-3199, CVE-2016-3081, CVE-2023-22894, CVE-2015-5477 | ProFTPD (SITE CPFR/CPTO), ONLYOFFICE Docs, Apache Struts 2 (Dynamic Method Invocation), Strapi admin panel, ISC BIND (TKEY) | Yes (KEV, 8 Oct; joint advisory AA26-281A) | These bugs date from 2015 to 2023, and CISA added them because China-linked actors are using them now. Run an external scan for any internet-facing instance and upgrade or retire it. Where an upgrade cannot happen this week, turn off ProFTPD’s SITE CPFR/CPTO commands and Struts Dynamic Method Invocation, and move Strapi admin panels off the internet. |
Still open from Weeks 39 and 40: Citrix NetScaler (the DTLS and default-configuration flaws, and the SAML denial-of-service flaw), Check Point Security Gateway/Spark and Security Management, F5 BIG-IP where APM is the OAuth authorization server, on-prem Arista VeloCloud Orchestrator, Cisco Catalyst SD-WAN Manager, Apple CoreGraphics and Zammad. Confirm the fixed build is installed.
What attackers are doing with the Atlassian bug: watchTowr says activity in the wild so far consists of fingerprinting and sweeps for configuration files, and it has not yet seen anyone use stolen credentials after a compromise. Crowd carries the most risk. watchTowr showed that the flaw can read crowd.properties, which stores the Crowd application password in plaintext, and that password can be used to create a user and add it to jira-administrators. If a Crowd or Jira server sat on the internet unpatched, rotate the Crowd application password and review recent user and group changes. Source · watchTowr update
KEV due dates are US federal deadlines under BOD 26-04 (the 8 October additions carry an 11 October federal date). They do not bind UAE organisations. Use them as a signal of urgency and follow your own regulator’s and internal patch timelines.
Top stories
1. A contractor’s missed patch let ShinyHunters into the FBI’s jobs platform
On 6 October, FBI cyber chief Brett Leatherman confirmed that the bureau had removed an unnamed contractor. He said the intrusion “occurred as the result of a security failure of a platform managed by a third-party organization — after a contractor failed to implement a security patch explicitly issued to secure the platform.” A person familiar with the matter told Nextgov/FCW that the platform was Oracle PeopleSoft and that Accenture handles patch management there. Reuters first reported the removal. ShinyHunters claimed the breach in September, and the stolen data includes employees’ addresses, phone numbers, spouse details, role information and medical records. Action: for every platform a managed service provider patches on your behalf, require evidence of the installed build within your critical-patch SLA, and check it with your own scanner rather than relying on the provider’s report. Source
2. FortiBleed is still running, and some victims are locked out of their own firewalls
The FBI and US Secret Service warned on 6 October that the FortiBleed credential campaign is still active against internet-facing FortiGate firewalls and SSL VPN gateways. The operators use reused or leaked credentials and crack weak legacy SHA-256 password hashes. Once in, they create their own admin accounts, and in some cases they delete or change the original accounts, which locks the owner out. They then sell the access to ransomware affiliates, which the advisory says currently include INC/Lynx and Payload. Action: take device management off the internet, or at least restrict it to trusted hosts or a local-in policy. Terminate all admin and VPN sessions and reset VPN and admin passwords. Enforce phishing-resistant MFA on remote access. Switch admin password storage to PBKDF2 (FortiOS 7.2.11 and later). Source
3. Hijacked maintainer accounts are pushing a fake “Security Audit” workflow that steals CI secrets
StepSecurity reported on 8 October that the GhostAction campaign used two compromised open-source maintainer accounts to push a malicious workflow into 345 repositories within minutes. The workflow sends the repository’s GitHub Actions secrets, plus any cloud, AI or SaaS credentials it finds in the code and the entire git history, to 193.32.204.199 over plain HTTP. In one run log, StepSecurity confirmed that the data had been sent. Socket later counted more than 500 accounts committing the same workflow to tens of thousands of repositories since 7 October. Action: search your organisation’s repositories for security-audit.yml, github_actions_security.yml or that IP address. Any hit since 31 August is a breach: remove the file from every branch, revoke the committing account’s tokens, and rotate every secret that ever appeared in that repository’s history. Require pull requests on default branches so a stolen token cannot commit straight to main. Source · Socket count
4. Attackers hijacked three country-code registries and obtained real HTTPS certificates for Google and other brands
Google disclosed on 6 October that attackers compromised the .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) registries and changed authoritative DNS records. That let them obtain valid certificates for several Google domains and for domains of other organisations, including some well-known global brands. Google says the certificate authorities did nothing wrong. Chrome blocked the certificates through CRLSets and the issuers revoked them, but Google warns that browser-side blocking should not be relied on, especially for non-Chrome users. Action: monitor Certificate Transparency logs for every domain you own, including regional ccTLD and parked domains, and publish restrictive CAA records with ACME account binding. Source
Threat radar
- Integrity Tech (Flax Typhoon): botnet-scale scanning combined with hands-on intrusion — A joint advisory from seven countries (Australia, Canada, Japan, New Zealand, Spain, the UK and the US), published 8 October, says actors enabled by Beijing-based Integrity Technology Group combine automated scanning tools, large botnets and hands-on exploitation to steal data worldwide. Their methods include cross-site scripting and password spraying against Microsoft Exchange, VPN software for persistence, and scripts that pull out email and credentials. The five older flaws in the patch table come from this advisory. The FBI also seized seven domains used to run the group’s MicroScan scanner and FishHub phishing tool. Action: turn off unused services and ports, put MFA on every service including Exchange/OWA, look for unexpected SoftEther VPN installs, and load the AA26-281A indicators into your SIEM. Source · FBI disruption
UAE & GCC watch
- No UAE or GCC incident is confirmed in this week’s sources (absence is not knowledge of the region). One claim to track: on 6 October, The National reported that UAE-based monitoring firm Hackmanac attributed the theft of more than 1.5 million files from the CRCC/Sama consortium, main contractor for Jeddah Central Stadium, to a group called WallStreet. The consortium had not responded, and the claim is not independently confirmed. Ransomware leak-site listings that name Gulf companies only on aggregator sites are not included. Source
- Saudi Arabia’s National Cybersecurity Authority (CERT) issued a Critical Citrix alert (2026-7908, 9 October) that links to the new NetScaler SAML bulletin, and a Critical SonicWall alert (2026-7901, 6 October). Source Earlier regional items stay on Previous Cyber Pulse.
One thing to do this week
On every internet-facing FortiGate, compare the list of admin accounts with the accounts you approved, and treat any extra account as an incident. Then terminate all admin and SSL VPN sessions, reset VPN and admin passwords, and take management off the internet (or limit it to trusted hosts). The FBI says FortiBleed operators add their own admin accounts and sometimes delete yours.
This issue: 5 patch-table entries (9 CVEs), 4 stories and 1 threat note. Compiled from public vendor advisories, CISA KEV and threat-intelligence reporting dated 5 to 11 October 2026. For awareness only — check vendor guidance before acting. Get this in your inbox every Monday: subscribe to the Monday Brief.