Weekly recap covered exploits, arrests and domain hijacks

The recap said attackers started testing Atlassian CVE-2026-21589 shortly after watchTowr released further technical detail. It said the flaw affected Atlassian Data Center products, including Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye.

It also reported that federal prosecutors charged Zohar Pinhasi over MonsterCloud's ransomware recovery work. According to the recap, prosecutors alleged that he told victims he could restore data without paying ransoms, then paid the ransom himself and charged clients more than the original demand.

The roundup said a new DarkSword iOS exploit-kit variant, called P7 DarkSword, added on-device keychain and crypto-wallet theft and two-way communication with attacker infrastructure. It also said UAC-0099 had changed MATCHBOIL so that it checked in every two minutes to fetch payloads.

The FBI and the Department of Justice said they had disrupted tools linked to Flax Typhoon, and CISA's Chris Butera said Chinese government hackers continued to seek access inside critical infrastructure networks. The FBI also said it had made a third arrest tied to ShinyHunters, with court papers, POLITICO and Brian Krebs identifying the suspect as Edward Dubrovsky.

Google said unknown actors had obtained HTTPS certificates for some Google domains after compromising third-party operators and changing authoritative DNS records. Searchlight Cyber said a GoBalance flaw could let attackers recover a site's signing scalar, and said Dread and other onion sites were redirected between 5 and 7 October.