Weekly Recap: Atlassian 0-Day Exploited, ShinyHunters Arrest, GoBalance Tor Hijack

Atlassian Flaw Exploited Within Hours of Disclosure

Threat actors began exploiting CVE-2026-21589, a critical arbitrary file access flaw (CVSS 9.3) in Atlassian Data Center products, just two hours after watchTowr released additional technical details. The bug affects Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye Data Center, and can expose sensitive files under certain conditions.

Ransomware, Arrests, and Takedowns

Zohar Pinhasi, owner of ransomware recovery firm MonsterCloud, was charged with wire fraud for allegedly paying ransoms while claiming he could restore data without them, then charging victims far more than the original demand. The FBI announced a third arrest in the ShinyHunters case, with court documents and reporters identifying the suspect as 54-year-old Toronto cybersecurity executive Edward Dubrovsky. The FBI and DOJ also disrupted tools used by China-linked group Flax Typhoon, including Microscan for reconnaissance and FishHub for spear-phishing and payload deployment. Google said attackers hijacked the .gh, .as, and .sl country-code domains after compromising third-party operators, obtaining unauthorized HTTPS certificates for Google domains and other organizations; Chrome blocked the certificates via CRLSets.

Tor Hijacks, Record Ransomware, and AI Evasion

Searchlight Cyber reported that a GoBalance load-balancing flaw let attackers recover master signing scalars and take over Dread's two onion addresses on October 5-7, redirecting them to rival platform Conclave. Comparitech recorded 2,627 ransomware attacks in Q3 2026, up 29% from Q2 and 61% year over year, with an average demand of $602,400. Cisco Talos found malware families FRUITSHELL, PLOTSAFE, HOLLOWCLAD, and MANTLEMAZE embedding natural-language instructions to evade automated AI analysis, including intimidation notes claiming the model is a monitored honeypot. Two Zammad flaws (CVE-2026-102489 and CVE-2026-102490) were exploited as zero-days against the Dutch Institute for Vulnerability Disclosure and added to CISA's KEV catalog, which mandated federal fixes by October 5, 2026.

Sources: The Hacker News