CISA Warns of China-Linked Hackers as Atlassian Flaw Exploitation Begins

CISA, the FBI, NSA and international partners issued a joint advisory on October 8 detailing how China-linked threat actors enabled by Integrity Technology Group combine botnets and hands-on exploitation to steal data from critical infrastructure, while attackers began exploiting a critical Atlassian Data Center file-access flaw within a day of its patch. Also this week: FortiBleed continues locking administrators out of Fortinet firewalls, SonicWall and Google disclosed separate security issues, and Lumen and Accenture Federal Services both named new security chiefs.

CISA, FBI, NSA warn of China-based Integrity Tech enabling global hacking

CISA, the FBI, NSA and international partners released a joint advisory on October 8 warning that Integrity Technology Group, a China-based company tied to the Chinese government, enables threat actors to combine automated scanning, large-scale botnets and hands-on exploitation to steal data from government, critical manufacturing, healthcare and IT organizations worldwide. The actors exploit Microsoft Exchange servers and VPN infrastructure, using techniques consistent with Flax Typhoon, Ethereal Panda and Red Juliett. CISOs should prioritize MFA, disabling unused ports and patching the advisory's listed CVEs. (CISA)

Attackers exploit critical Atlassian Data Center flaw a day after patch

One day after Atlassian patched a critical arbitrary file access vulnerability, CVE-2026-21589, in its self-managed Data Center products, researchers published technical details and attackers began hitting honeypots with exploitation attempts. The flaw, rated 9.3 CVSS, affects Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye Data Center versions, letting unauthenticated attackers read specific files, including Crowd credential files that can enable full admin takeover. Atlassian urges immediate patching or removing affected instances from the internet. (Help Net Security)

FBI, Secret Service: FortiBleed campaign still locking out Fortinet admins

A joint FBI and U.S. Secret Service advisory warns that the FortiBleed campaign targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways remains active, with more than 86,644 compromised devices identified across 194 countries. Attackers create or delete admin accounts to lock organizations out of their own devices while using cracked credentials and infostealer logs to move laterally and enumerate Active Directory. Access is reportedly sold to affiliates of the INC/Lynx and Payload ransomware groups, and recovery may require steps beyond standard patching and password resets. (Help Net Security)

SonicWall patches critical pre-auth SSRF flaw in SMA 1000 appliances

SonicWall patched four vulnerabilities in its SMA 1000 series SSL VPN gateways, including CVE-2026-102255, a pre-authentication SSRF flaw rated 9.6 that could let unauthenticated remote attackers direct the appliance to reach internal functionality. SonicWall says there is no evidence of in-the-wild exploitation yet, but the SMA line has repeatedly been targeted by zero-day attacks in 2026. Affected models include the 6210, 7210 and 8200v; customers should update to firmware 12.4.3-03670 or 12.5.0-03082 or later. (Help Net Security)

Hijacked ccTLD registries used to obtain unauthorized HTTPS certificates for Google domains

Google disclosed that attackers compromised third-party operators of the .gh, .sl and .as country-code domain registries and used that access to obtain unauthorized HTTPS certificates for several Google domains and other large organizations' domains. Google blocked the certificates in Chrome via CRLSets and worked with issuing certificate authorities to revoke them, protecting other browsers too. The company said its own systems were not compromised and warned that browser-side blocking should not be an organization's only defense against DNS hijacking. (Help Net Security)

Lumen names former Cox CISO Kim Keever as chief security officer

Lumen Technologies named Kim Keever as chief security officer, overseeing security strategy across its physical, digital and operational assets. Keever spent more than a decade as CISO at Cox Communications, building its cyber risk management program across network security, threat intelligence, identity management and operational technology resilience, and previously held security leadership roles at The Coca-Cola Company. The appointment follows Lumen's $475 million acquisition of Alkira as the company expands its network-as-a-service offerings. (SC Media)

Accenture Federal Services names Nathaniel Parker as CISO

Accenture Federal Services appointed Nathaniel Parker, a cybersecurity executive and U.S. Marine Corps veteran, as chief information security officer to guide the company's cybersecurity strategy and harden its defenses. Parker previously spent about seven years as CISO of BCG Federal and earlier worked at MIT Lincoln Laboratory and BAE Systems. The move follows other recent leadership additions at Accenture Federal Services, including a chief AI officer named in January and a new board director added in August. (GovConWire)