Pwning

Since 7 October 2026, internet-exposed AhsayCBS backup consoles have been running foreign commands as SYSTEM: CVE-2026-105133 (auth bypass in checkSysPwd) chained with CVE-2026-105134 (OS command injection in the Replication Receiver, CVSS 9.3). Huntress saw at least five victims by 8 October, JSP webshells, and an XMRig miner disguised as edge.exe. The punchline: build 10.3.4, named as the fix in the CVE records, is itself vulnerable — Ahsay retracted it on 10 October.

On 5 October 2026 Atlassian published an out-of-band bulletin for CVE-2026-21589: an unauthenticated arbitrary file read in eight self-hosted Data Center products (Jira, Confluence, Bitbucket, Bamboo, Crowd, JSM, Crucible, Fisheye), CVSS 9.3. Via crowd.properties the read reaches Jira administrator in the lab. watchTowr published root cause and PoC on 6 October — two hours later the first exploit attempts hit honeypots.