The first week of October 2026 was marked by several significant events: a third arrest in the ShinyHunters case, the seizure of tools used by the Flax Typhoon group, a massive release of critical patches from Atlassian, Fortinet and dozens of other vendors, as well as the emergence of a new class of techniques — embedding natural-language instructions into malware to mislead AI analyzers. Below is a breakdown of the most important events with impact assessment and recommendations.
Critical vulnerabilities of the week
Atlassian: arbitrary file access (CVE-2026-21589)
The CVE-2026-21589 vulnerability (CVSS 9.3) affects numerous Atlassian Data Center products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. The vulnerability allows arbitrary file access on the server. According to the Atlassian advisory, to exploit it an attacker must already know the exact name and path of the target file — directory enumeration is not possible.
An important detail to consider when assessing risk: Atlassian cloud products have already been patched, and the vendor reports no signs of exploitation in the cloud environment. Thus, urgent action is required only from organizations using self-managed (Data Center) installations. This is a significant distinction that determines response priority.
According to The Hacker News, exploitation of the vulnerability in honeypot networks began just two hours after watchTowr researchers published technical details. However, no independent confirmation of active exploitation was found in primary sources available for verification.
Fortinet FortiPAM: authentication bypass in Chrome extension
Fortinet published advisory FG-IR-26-168 with a CVSSv3 score of 9.6, describing an authentication bypass vulnerability (CWE-287). A notable inconsistency: the advisory header refers to “FortiPAM Server”, while the body describes the vulnerability specifically in the Fortinet Privileged Access Agent Chrome Extension. The vulnerability allows a remote unauthenticated attacker to reroute a user’s browser traffic through attacker-controlled servers when they visit a malicious site.
Zammad: two zero-days exploited in the wild
Two vulnerabilities in the Zammad ticketing system — CVE-2026-102489 (remote code execution, versions 6.3.0–6.5.4) and CVE-2026-102490 (privilege escalation, all versions 1.5.0–7.1.0-alpha) — were used as zero-days in the breach of the Dutch Institute for Vulnerability Disclosure (DIVD). CISA added both vulnerabilities to the Known Exploited Vulnerabilities catalog on October 2 with a remediation deadline of October 5, 2026.
Law enforcement operations
Third arrest in the ShinyHunters case
The FBI announced a third arrest as part of its investigation into the ShinyHunters group, which is linked to the incident on the FBIjobs.gov platform. According to court documents and independent journalists, the arrested individual is Edward Dubrovsky — a 54-year-old Canadian cybersecurity executive and investor from Toronto. He faces charges of conspiracy to extort and obstructing commercial activity through threats. The group itself stated in its Telegram channel that it intends to cease activity on the platform in connection with the arrests.
Seizure of Flax Typhoon tools
According to a U.S. Department of Justice statement, the FBI carried out a court-authorized seizure of Microscan (reconnaissance and vulnerability scanning) and FishHub (targeted phishing and payload delivery) tools linked to the Chinese APT group Flax Typhoon and the company Integrity Technology Group. DOJ states that Microscan’s targets included an energy company in South Carolina, airports in Japan and Poland, and Taiwanese gas and energy infrastructure facilities. FishHub, according to the indictment, was used against roughly 20 Taiwanese universities.
Among the seized domains associated with FishHub delivery:
- 98aicai[.]com
- 98aicode[.]com
- outlook3650[.]com
- youtubecard[.]com
- linkedinns[.]net
We have already written about vulnerabilities in Cisco products that also appeared in the context of attacks on critical infrastructure.
New techniques: AI evasion in malware
According to a Cisco Talos study, malware authors have begun embedding natural-language instructions directly into code in order to influence the results of automated AI analysis. The technique, dubbed AI-Analysis Evasion (A3), has been identified in four malware families: FRUITSHELL, PLOTSAFE, HOLLOWCLAD and MANTLEMAZE. A total of 84 samples were analyzed for the period from January 2025 to July 2026.
The methods range from anti-analysis comments in source code to template instructions that mimic warnings about a honeypot environment. According to Talos, at best such techniques skewed AI analysis results in favor of the attacker in roughly 35% of test runs. At the same time, the researchers note that the need to store instructions in clear text creates a stable detection surface — organizations using AI tools for malware analysis can build detection rules specifically around these textual patterns.
Akira: a typical attack chain
A Huntress investigation into a September attack by the Akira group revealed a characteristic sequence of actions: initial access via RDP, disabling antivirus, deploying Rclone for data exfiltration, installing a GOST tunnel (likely to maintain persistent access), and final deployment of the ransomware. Among the indicators of compromise is the IP address of the GOST tunnel C2 server: 64.227.4.134. This indicator is specific to the particular incident and requires contextual validation before blocking.
Other significant events
According to OpenAI, two influence operations were disrupted — one Russian (Dark Clark) and one Iranian (Bogus Bylines) — that used ChatGPT to create fake journalist personas and think tanks. The Iranian operation successfully placed almost 100 articles in various outlets, some of which had an audience of 2 million followers on Facebook. OpenAI notes that it was not possible to identify a specific actor behind the Iranian operation.
Comparitech statistics for Q3 2026 record a record-high 2,627 ransomware incidents — an increase of 29% over the previous quarter and 61% over Q3 2025. The median ransom demand was $150,000, with an average of $602,400.
Recommendations
- Atlassian Data Center: immediately update all self-managed Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye installations to the versions listed in the vendor’s advisory. Cloud customers do not need to take action.
- Zammad: update to a version that addresses CVE-2026-102489 and CVE-2026-102490. U.S. federal agencies were required to complete patching by October 5.
- FortiPAM: check for the Fortinet Privileged Access Agent extension in Chrome browsers and apply the update according to the Fortinet advisory.
- Flax Typhoon IOC: check network logs for connections to the listed domains (98aicai[.]com, outlook3650[.]com and others) and block them.
- Akira: monitor the use of Rclone and GOST in the corporate environment, restrict RDP access and verify the integrity of antivirus agents.
The week demonstrated two parallel trends: law enforcement agencies are increasing pressure on cybercriminal groups (ShinyHunters, Flax Typhoon, Empire Market), while at the same time attackers are mastering fundamentally new techniques — from deceiving AI analyzers to exploiting vulnerabilities within hours of disclosure. The top priorities for security teams in the coming days are patching Atlassian Data Center and Zammad, and checking infrastructure for Flax Typhoon indicators.
