Duna's Kiat
All editions
News

CyberNews: 07/10/2026 Edition

Today’s roundup

  • Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
  • FBI Warns FortiBleed Remains Active After Amassing 86,644 Fortinet Device Credentials
  • Pwn2Own Hackers Find 32 Zero-Day Vulnerabilities on Day One
  • Danish CPR Breach Highlights Challenge of Supply Chain Risk
  • Linux Backdoors Impersonate Email Security Tools to Evade Detection in Korea and Taiwan
  • Fake ChatGPT, Gemini, and Claude Ad Portals Capture Credentials and MFA Codes
  • Nikkei Discloses Two Employee Cloud Account Compromises
  • ClickFix Attack Hides VBScript Payload in Browser Cache
  • Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws

    • Summary

    Attackers began exploiting CVE-2026-21589 (CVSS 9.3) within two hours of public details. The arbitrary file access flaw affects Atlassian Data Center products including Bitbucket, Confluence, Jira Service Management and Jira Software, and can expose sensitive files under certain conditions.

    The FBI and the Secret Service warned that the FortiBleed credential harvesting campaign is still active against internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. It exploits reused or leaked credentials and legacy SHA-256 password storage and has amassed 86,644 device credentials.

    Ethical hackers found 32 zero-day vulnerabilities in various products on the first day of Pwn2Own Ireland.

    A breach affecting 8.8 million citizens in Denmark's Central Register of Persons (CPR) occurred through third-party access, highlighting supply chain risk.

    Linux backdoors targeting telecom and network appliances in South Korea and Taiwan disguise their traffic as email services and take the names of legitimate processes to evade detection.

    Researchers detailed a human-operated phishing platform impersonating advertising products for AI chatbots such as Gemini, Claude, ChatGPT, Perplexity, Meta Muse and Manus to capture credentials and MFA codes.

    Nikkei disclosed that two employee cloud accounts were compromised, one of which was used to send 9,000 phishing emails.

    A new ClickFix technique stages its VBScript payload in the browser cache to get around the length limit of the Windows Run dialog.

    Anthropic expanded a program giving vetted cybersecurity teams access to its AI models with reduced safeguards, and said its Project Glasswing initiative uncovered at least 129,000 verified software vulnerabilities between April and July 2026.

    Want to dig deeper?

    Vulnerabilities

    CVE-2026-21589 Critical