⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More

This week's roundup opens with active exploitation of a critical Atlassian flaw, CVE-2026-21589 (CVSS 9.3), which lets attackers reach sensitive files across Bitbucket, Confluence, Jira Software/Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center products; attacks reportedly started just two hours after watchTowr published technical details. Other headlines include the FBI's third arrest tied to the ShinyHunters extortion crew, Google's discovery that attackers hijacked Ghana, American Samoa, and Sierra Leone ccTLDs to forge HTTPS certificates for Google and other major brands, and a flaw in the GoBalance load balancer used to hijack Tor .onion sites, including the Dread darknet forum. Also covered: an updated P7 DarkSword iOS exploit kit stealing crypto wallets and keychain data, malware families embedding text designed to trick AI-based analysis tools, the FBI's takedown of hacking infrastructure tied to China's Flax Typhoon, and a long list of urgent CVEs across Dell, Chrome, SonicWall, Elasticsearch, Apache Struts, Veeam, Cisco, Splunk, and WordPress plugins that administrators should patch without delay.