erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: October 5, 2026

1 editorial brief and 17 critical advisories.

All digests · RSS · Markdown

Take stock

  • Act now: Atlassian Data Center File Read CVE-2026-21589 Exploited. Anyone running self-managed Jira, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible or Fisheye, especially instances reachable from the internet.
  • npm: 15 critical advisories (vm2, simple-git, @simple-git/argv-parser, @capacitor/android, @capacitor/ios, seroval, proxy-addr, tinypool). Check with npm audit (or: npm ls <package>).
  • PyPI: 2 critical advisories (langflow). Check with pip-audit (or: pip show <package>).
  • Maven: 1 critical advisory (com.capacitorjs:core). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • Swift: 1 critical advisory (github.com/ionic-team/capacitor-swift-pm). Check with swift package show-dependencies.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-21589

Atlassian Data Center File Read CVE-2026-21589 Exploited

Every self-managed Atlassian Data Center product is affected, a public detection script exists and CISA confirms exploitation; patch to a fixed LTS or block traversal patterns at the edge today.

Must act: Anyone running self-managed Jira, Jira Service Management, Confluence, Bitbucket, Bamboo, Crowd, Crucible or Fisheye, especially instances reachable from the internet.

Can relax: Atlassian Cloud customers: Atlassian says Cloud is patched, found no evidence of exploitation there, and requires no customer action.

  1. List every self-managed Atlassian instance, including test, staging and Bitbucket mirrors.
  2. Upgrade each to a fixed version for its line (or the latest release), on every cluster node.
  3. If you cannot patch today, take internet-facing instances off the internet, or block URLs with '..' next to /, \ or :: (including URL-encoded forms) using Atlassian's WAF regex or Tomcat RewriteValve rule.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 17

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 15

Check: npm audit (or: npm ls <package>)

PyPI 2

Check: pip-audit (or: pip show <package>)

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Swift 1

Check: swift package show-dependencies