Atlassian has disclosed a critical path traversal vulnerability affecting eight of its self-hosted Data Center products, including Jira, Confluence and Bitbucket. Tracked as CVE-2026-21589 with a CVSS score of 9.3, the flaw can allow an unauthenticated party to read certain files from the web application root directory.
Atlassian’s cloud-hosted products have already been fixed. Organizations running their own Data Center instances need to update them.
Attackers are exploiting a now-patched vulnerability in Zimbra Collaboration Suite (ZCS) to deploy web shells and gain access to mailbox data, according to the Microsoft Security Research team.
The flaw, tracked as CVE-2026-73570 (CVSS score: 8.9), is an unauthenticated operating system command injection that can lead to remote code execution. The server is exposed when SNMP notifications are enabled and the optional zimbra-snmp package is installed. An attacker only needs to send a specially crafted SMTP request — in other words, an email — to an internet-facing Zimbra server. No authentication or user interaction is required. Zimbra fixed the issue in July 2026 with version 10.1.20.
CRITICAL SECURITY ALERT: A massive-scale vulnerability affecting React Server Components (CVE-2025-55182) has exposed over 644,000 domains and 165,000 unique IP addresses to potential remote code execution and security bypass attacks. This represents one of the most widespread web application vulnerabilities discovered in 2025, with immediate action required from all organizations using React-based applications.
Read More
Security researchers have identified a sophisticated malware distribution campaign dubbed JS#SMUGGLER that exploits compromised websites to deliver NetSupport RAT. This campaign employs device-aware targeting, heavily obfuscated JavaScript loaders, and fileless execution techniques to evade detection and establish persistent remote access on victim systems.
Read More