Project
Open-source Java servlet container and web server from the Apache Software Foundation, implementing Jakarta Servlet, JSP and WebSocket specifications.
Horizon3 detailed how two AhsayCBS backup-server flaws chain into unauthenticated code execution as SYSTEM and root. Attackers were already planting webshells through the chain before Ahsay issued hotfixes on 12 October 2026.
Reality
Previdian recorded exploitation attempts against Atlassian's CVE-2026-21589 within two hours of watchTowr publishing the arbitrary file access technique. The CVSS 9.3 flaw lets an unauthenticated attacker read specific webroot files across eight Data Center products.
Perspective Coverage
6 publishersReality
Atlassian disclosed CVE-2026-21589, a 9.3-rated unauthenticated file-read flaw affecting all eight of its self-hosted Data Center products. A public proof of concept drew exploitation attempts within two hours of landing on 7 October.
Reality
Huntress traced a September 2026 intrusion in which the actor compiled a Monero miner on the endpoint, using a MagicINFO flaw Samsung fixed 16 months earlier. The build step is loud in telemetry, but it ran only after Defender had been disabled.
Reality
Spring gives three places to run code around a request, and each one sees a different amount. A dev.to walkthrough puts filters outside the DispatcherServlet, interceptors inside it, and aspects around any bean method.
Reality
Wiz says a TeamCity honeypot exposing JDWP was mining Monero within hours, and GreyNoise counted more than 6,000 unique IPs scanning for the protocol in 90 days.
Reality