Atlassian, Splunk Patch Critical Vulnerabilities

Atlassian and Splunk on Wednesday announced patches for multiple vulnerabilities in their products, including critical-severity flaws.

Splunk resolved a critical issue in AI Toolkit that could allow authenticated attackers with admin roles to execute arbitrary OS commands on the host the Splunk Enterprise instance runs on.

“The vulnerability is possible because of an unsafe shell execution pattern in the btool configuration helper, which constructs OS command strings from dynamic parameters without disabling shell interpretation,” Splunk explains.

Tracked as CVE-2026-20266 (CVSS score of 9.1), the security defect was addressed in Splunk AI Toolkit version 5.7.4. If upgrading is not possible, Splunk recommends uninstalling the AI Toolkit as a mitigation.

The update also addresses CVE-2026-20265, a medium-severity information disclosure bug caused by an insecure default domain allowlist. An attacker holding the admin or power role could cause the AI Toolkit to make outbound HTTP requests to attacker-controlled servers, leading to data exfiltration.

Atlassian published 100 security bulletins that address dozens of security defects across Bamboo Data Center and Server, Bitbucket Data Center and Server, Confluence Data Center and Server, Crowd Data Center and Server, Fisheye/Crucible, Jira Data Center and Server, and Jira Service Management Data Center and Server.

Advertisement. Scroll to continue reading.

All the weaknesses resolved with the fresh security updates appear to affect third-party dependencies used in Atlassian’s products.

These include critical-severity issues in Axios (CVE-2026-42043, CVE-2026-40175, and CVE-2026-42264), Apache Tomcat (CVE-2026-41293, CVE-2026-43512, CVE-2026-41293, CVE-2026-43515, and CVE-2026-43515), and Netty (CVE-2026-42584).

Users are advised to update to a patched version of the affected Atlassian products as soon as possible.

https://www.securityweek.com/atlassian-splunk-patch-critical-vulnerabilities/

OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds

Including npm packages in software development projects saves time but can introduce unseen but known vulnerabilities.

CVE Lite CLI is a lightweight command line security scanner that operates on lockfiles during software development. It focuses on JavaScript and Typescript files and is an OSV-powered dependency scanner supporting npm, pnpm and Yarn.

It is an open source tool developed by Sonu Kapoor, now community supported and recently adopted as an OWASP Incubator Project.

Kapoor has been a software developer for 25 years and has experienced and understands all the frustrations and delays in the secure software development process. It is these frustrations and delays that CVE Lite CLI is designed to ease.

“Each project you build doesn’t simply contain your own code. It pulls in hundreds of open source packages. Each of those packages might pull in other packages with their own dependencies, until a typical JavaScript project might involve thousands of these dependencies,” he explains.

The developer has probably never heard of the majority and doesn’t know how they got included. At this stage the developer is flying blind. “Any one of those packages could have a known security vulnerability – and most developers have no idea it’s there.”

Advertisement. Scroll to continue reading.

SBOMs were introduced to solve this problem, especially within OSS. In theory, they should solve this problem; but SBOMs cannot be trusted, especially within OSS. Developers must use scanners to locate vulnerabilities in unknown but automatically included npm packages. Scanners exist, but they can often only be used at a non-optimal time, and do not provide fully optimal assistance.

“CVE Lite CLI is a free, open-source command line tool that scans your projects in seconds and tells you exactly which included packages contain a vulnerability. But it doesn’t just tell you what is broken – it tells you how to fix it: it is not simply a huge log or list of warnings,” he continues. “It uses its own internal algorithm to analyze any vulnerable dependency and provide the safest command to include an alternative non-vulnerable package that won’t break the application.”

The tool allows the developer to produce secure code as part of the process of coding.

Today, much coding is done with the assistance of an AI coding agent. An alternative approach would be to allow the AI to do the scanning; but that produces its own problems even if we ignore the current concern that AI agents are not sufficiently security aware.

“With AI, a scan in the CI is usually the last step that happens after all the other tasks, the npm run build, any linting, unit tests, building an image – and then it runs the CI scan. Depending on how big your project is, this could be a 10 minute thing, but in most enterprise companies I’ve worked in, it takes anywhere between one to two or three hours. And even that depends on an agent being free. So, in CI, if an agent isn’t free, you’re probably waiting another couple of hours before you see the result of the scan.”

So that’s the first issue: time wasted. Few developers have the time to just sit and wait for hours. Most will move on and start the next project – which produces the second issue: loss of context in the first project. Humans are no different to AI agents in this respect. Loss or lack of context can produce bad decisions. The effect of any lack of immediate context surfaces when the developer receives the result of the AI scan.

“Most of these AI scans give you a large log of problems but don’t give you any fixes. They might give you a coarse-grained command, such as ’This package has this CVE: fix it’, but they don’t tell you how to fix it. CVE Lite CLI will give you the command you need to replace the vulnerable npm with a safe npm package.”

The result is a combination of wasted time and increased frustration, all of which could be eliminated by securing the code and its npm or pnpm or Yarn inclusions as they are included during development. Each CVE Lite CLI runs on the developer’s own device, can be used on demand instantly, completes its scan within seconds, and helps fix any discovered vulnerable inclusions.

Needless to say, perhaps, it automatically scans the new npm that its recommended command brings in, ensuring that the proposed fix is a genuine fix. Kapoor cites an example from experience where the developer went through more than 25 separate iterations of seeking a safe alternative to a vulnerable npm package.

“Imagine the frustration,” he says. “You have to install the package. The CI scan says it contains a vulnerability, so you try a different npm. You push it up to CI, you wait for CI to run, and CI says you’re still vulnerable. Okay, so you try the next version. And you go into the same loop again: you push it up, you wait for CI, and it tells you again it’s vulnerable.” Imagine doing this 25 times. That’s a huge and frustrating waste of time.

The biggest problem is when such frustration and time-wasting becomes a hassle. “What can happen then,” he adds, “is that some developers start ignoring the vulnerability out of sheer frustration when they should be fixing it. CVE Lite CLI prevents this by running local scans within seconds, allowing the developer to see the problem, fix the problem, and then move on.”

Learn More at CodeSecCon – The event that defines how modern applications are built, secured, and maintained in the age of AI.

https://www.securityweek.com/owasp-incubator-project-helps-developers-find-and-fix-vulnerable-dependencies-in-seconds/

Chrome 149 Patches 429 Vulnerabilities

Google this week promoted Chrome 149 to the stable channel with patches for 429 vulnerabilities, a record for a single Chrome refresh.

Already exceeding several times the total number of Chrome security fixes released in 2025, the surge in Chrome flaws is likely driven by AI use, which led Google to lower Chrome bug bounties in April.

Over 100 of the newly resolved security defects are critical and high-severity issues, most of which are use-after-free and insufficient validation of untrusted input flaws.

The most severe of the bugs is CVE-2026-10881 (CVSS score of 9.6), an out-of-bounds read and write weakness in the ANGLE graphics engine.

Remote attackers could exploit the vulnerability to escape Chrome’s sandbox via crafted HTML pages, potentially achieving code execution on the underlying operating system.

In its advisory, Google says it handed out a $97,000 bug bounty reward to the external researcher who reported the issue.

Advertisement. Scroll to continue reading.

Two other critical-severity defects were reported by external researchers, namely CVE-2026-10882, a use-after-free issue in Network, which earned the reporting researcher a $43,000 reward, and CVE-2026-10883, an out-of-bounds write in ANGLE that was awarded a $5,000 bug bounty.

The remaining 19 critical-severity vulnerabilities addressed in this Chrome release were discovered by Google. Out of approximately 90 high-severity flaws, only 10 were reported by external researchers.

Approximately 40 of the over 300 medium and low-severity weaknesses resolved with the update were reported by external researchers.

Most of the patched weaknesses were use-after-free and insufficient validation of untrusted input issues. Numerous inappropriate implementation, insufficient policy enforcement, and out-of-bounds flaws were also addressed.

Google paid roughly $208,000 in bug bounty rewards to the reporting researchers, but the final amount could be much higher, as the company has yet to disclose the amounts for over a dozen reports.

The latest Chrome iteration is now rolling out as version 149.0.7827.53 for Linux and versions 149.0.7827.53/54 for Windows and macOS.

https://www.securityweek.com/chrome-149-patches-429-vulnerabilities/

Kirki, Burst Statistics WordPress Plugin Flaws in Attackers’ Crosshairs

Hundreds of thousands of websites are potentially exposed to attacks exploiting two vulnerabilities in the Kirki and Burst Statistics WordPress plugins, Defiant warns.

Kirki provides website and freeform page creation, and WordPress customizer enhancements. The plugin’s versions 6.0.0 to 6.0.6 are affected by an unauthenticated privilege escalation and account takeover bug.

Tracked as CVE-2026-8206 (CVSS score of 9.8), the issue impacted the plugin’s password reset flow, which allowed attackers to provide a username and an arbitrary email address and have a password reset key sent to that address.

“This means an unauthenticated attacker can send a request specifying a high-privileged username together with an attacker-controlled email address and receive a valid password reset link for the targeted account,” Defiant explains.

The attacker can then use the reset link to take control of the targeted account. By resetting the password for an administrative account, the attacker can take over the entire website.

A lightweight plugin for WordPress, Burst Statistics provides users with an intuitive analytics dashboard with insights into site traffic, visitor sources, page performance, and more.

Advertisement. Scroll to continue reading.

Versions 3.4.0 to 3.4.1.1 of the plugin were affected by an authentication bypass vulnerability that allowed unauthenticated attackers to elevate their privileges to administrator and take control of a vulnerable site.

The bug existed because the function responsible for validating application passwords from the Authorization header contained an incorrect return-value, allowing attackers to send a REST API request and impersonate an administrator for the duration of the request.

“The plugin incorrectly treats the request as authenticated and sets the current user to the supplied administrator account, allowing unauthorized access to administrator-level REST API functionality, such as creating a new administrator account,” Defiant notes.

The web protection firm says it has blocked thousands of attacks targeting these vulnerabilities over the past 24 hours and warns that hundreds of thousands of websites are potentially at risk.

Kirki has over 500,000 active installations, but only 150,000 sites are believed to be running a vulnerable plugin version. Burst Statistics has more than 200,000 active installations.

Users are advised to update to Kirki version 6.0.7 or newer, and to Burst Statistics version 3.4.2 or newer, which contain patches for the exploited security defects.

https://www.securityweek.com/kirki-burst-statistics-wordpress-plugin-flaws-in-attackers-crosshairs/

Organizations Warned of Exploited Linux Kernel Vulnerability

The US cybersecurity agency CISA on Tuesday warned of in-the-wild exploitation of a Linux kernel vulnerability that leads to container escapes.

Tracked as CVE-2022-0492 (CVSS score of 7.8), the issue is described as an improper authentication vulnerability that could allow attackers to elevate their privileges and bypass the namespace isolation.

The security defect was found in cgroups, the Linux kernel’s control groups feature that specifies which OS resources a group of processes can use. While there are two control group versions, only cgroups v1 is affected.

Together with namespaces, cgroups can be used for process isolation and to restrict access to certain resources, which makes the feature essential for container creation.

Due to the vulnerability, any user could modify the release_agent file residing at the root of the cgroup hierarchy, which runs as root within the cgroup namespace as part of cgroup v1’s notification mechanism when a cgroup becomes empty.

“It is then possible to create a malicious script that is located on the host filesystem that will be run as root as part of the cgroup notification process, essentially allowing for a container escape and privilege escalation,” HackTheBox explains.

Advertisement. Scroll to continue reading.

Additionally, the bug allowed attackers to create a new user namespace with admin privileges and then create a cgroup with a malicious release_agent file, triggering the exploit.

Technical details on CVE-2022-0492 were published roughly three years ago, but its in-the-wild exploitation was reported only this week, one day before CISA’s alert.

Kaspersky mentioned the exploitation of CVE-2022-0492 in a blog post describing attacks on container environments, but has not specified who is behind the attacks, nor who the victims are.

On Tuesday, the cybersecurity agency added the CVE to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it by June 5.

CISA also urged the immediate patching of CVE-2025-48595, a high-severity flaw in Android’s Framework component. Google patched the issue this week, warning that it has been exploited as a zero-day.

https://www.securityweek.com/organizations-warned-of-exploited-linux-kernel-vulnerability/

‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in Seconds

Known denial-of-service (DoS) techniques can be chained together in a new exploit that can knock major web servers offline, Calif security researchers warn.

Dubbed HTTP/2 Bomb and discovered using OpenAI’s Codex, the exploit combines a compression bomb that targets HTTP/2’s header compression scheme (HPACK) with a Slowloris-style hold that prevents the server from freeing memory.

According to California-based cybersecurity firm Calif, the attack potentially affects over 880,000 websites that support HTTP/2 and run default NGINX, Apache HTTPD, Microsoft IIS, Envoy, or Cloudflare Pingora configurations.

Furthermore, the company says, an attack can be launched from a home computer on a 100 Mbps connection and can render any of these servers unavailable within seconds.

The techniques chained by the exploit are not new. In fact, three of the underlying issues were disclosed a decade ago, while another was resolved last year.

The first part of the exploit uses HPACK Bomb (tracked as CVE-2016-6581), a compression-layer attack relying on small messages that turn into gigabytes of data once they reach the destination server.

Advertisement. Scroll to continue reading.

Last year, the attack was demonstrated against Apache HTTPD with a 4000x amplification rate, and was resolved in Apache HTTP Server version 2.4.64 as CVE-2025-53020.

The second part of the new exploit targets CVE-2016-8740 and CVE-2016-1546 (Slow Read), two Apache HTTPD flaws leading to DoS conditions via Continuation frames in an HTTP/2 request and via modified flow-control windows.

These HTTP/2 Slowloris-type issues are abused for memory exhaustion by advertising a zero-byte flow-control window so that the server does not send a response, and then resetting the send timeout to prevent the server from freeing memory allocations.

“What’s new here is where the amplification comes from. The classic bomb stuffs a large value into the table and references it repeatedly, so servers learned to cap the total decoded header size,” Calif notes.

“Our variant goes the other way: the header is nearly empty, and the amplification comes from the per-entry bookkeeping the server allocates around it. The decoded-size limit never fires because there’s almost nothing to decode,” the company explains.

Calif also identified a bypass for servers that cap the header-field count, and released proof-of-concept (PoC) code to demonstrate the attack.

The company says NGINX resolved the bug in April, while Apache rolled out fixes in late May (and issued CVE-2026-49975). Microsoft IIS, Envoy, and Cloudflare Pingora have not been patched at the time of writing.

“The other thing worth noting is how this exploit was found. Both halves have been public for a decade. What Codex did was read the codebases, recognize that the two compose, and build the combined attack. That combination is obvious once you see it, and yet as far as we can tell no human had put it together against these servers,” Calif notes.

https://www.securityweek.com/http-2-bomb-exploit-knocks-web-servers-offline-in-seconds/

Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis

Two reports offer differing viewpoints. One suggests a failure of tools to provide what security teams really need. The other suggests the tools exist but are not properly managed.

The industrialization of cybercrime threatens to overwhelm cyber defense. It’s a process that started before the arrival of ChatGPT, was supercharged by the age of AI, and is now typified as the post-Mythos era. It’s a time when defenders must improve their performance or cede the battleground to the adversary. Applications are the battlefield. The speed, scale and sophistication of AI-assisted attacks is difficult to contain.

“AI is not just creating more vulnerabilities. It is exposing the fact that companies cannot fix known vulnerabilities fast enough,” explains Daniel Shechter, CEO and co-founder at Miggo Security. “For years, security programs have been measured by how well they find risk before software goes live. Frontier AI like Mythos changes the question. If attackers can move from disclosure to exploit in hours, boards and CISOs need to understand how long the business remains exposed, and what can be done to mitigate quickly and efficiently.”

The Cloud Security Alliance (CSA) State of Modern Application and AI Security report (PDF), commissioned by Miggo and published on June 2, 2026, confirms and explains this new reality. CSA surveyed more than 900 cybersecurity leaders and found that vulnerabilities in this post-Mythos era are evading the pre-production phase while 82% of organizations lack effective runtime visibility.

“The real challenge begins once applications are in production, where security teams must rapidly determine which exposures are truly exploitable, prioritize the risks that matter most, and respond before attackers can take advantage,” suggests Daniel Shechter, CEO and co-founder at Miggo Security.

Most breaches are driven by known vulnerabilities. Eighty percent of the companies surveyed have suffered at least one incident involving a known vulnerability in the last year. If it is known, it is almost certainly patchable; but in the post-Mythos era there are too many patches to handle. The biggest problem is knowing which of those vulnerabilities are exploitable and most urgently need patching.

Advertisement. Scroll to continue reading.

Only 9% remediate critical vulnerabilities within 24 hours; with74% take one to seven days. Patch time is important: Organizations taking four or more days had a 97% incident rate. Those taking three or less had a 67% rate. The implication is that patch rates must be increased and exploitable vulnerabilities better understood – and preferably both.

It gets more complicated, and urgent, in runtime, which is described as the breach battlefield. Most organizations only know what happened after reconstructing the event after the horse has bolted. Most (73%) would adopt virtual patching if they had better confidence in minimal false positives; but only 17% configure WAFs for automatic blocking, with 56% citing a lack of application context as the reason.

Because of the runtime difficulties, there is an intention by 42% of the organizations to increase investment in runtime monitoring and protection over the next few years. But since protection is always better than cure, the bulk of investment (52%) remains in pre-production such as CI/CD build protection.

The potential solutions are clear. Improved visibility into vulnerability exploitability together with better all-round contextual understanding of the application concerned – and its effect on business stability – would allow autonomous patching for many vulnerabilities and confidence in increased automated blocking.

A separate FireMon Insights report, also published June 2, 2026, suggests that concern over the automated use of firewalls as a security barrier is unsurprising but at least partially due to a lack of human oversight. FireMon discusses firewalls in general, but the same principles will apply to WAFs.

“Firewall complexity is no longer just an operational problem. It is a control problem,” says Jody Brazil, CEO at FireMon. “Security teams have massive investments in firewalls, cloud, and segmentation platforms, but without control of policy those environments become difficult to manage securely. The problem is no longer lack of tools. It is lack of operational control.”

It concludes that manual policy management is inefficient and allows risk across the attack surface to continue to expand rapidly, primarily due to an environment in which high severity policy failures persist over extended periods of time, and are exacerbated by unused and redundant rules.

FireMon suggests a failure in human management rather than firewall capability. For example, 45% of firewall rules lack an owner or documentation, 17% are redundant or shadowed, and 69% are unused.

“Firewall complexity is no longer just an operational problem. It is a control problem,” adds Brazil. “Security teams have massive investments in firewalls, cloud, and segmentation platforms, but without control of policy those environments become difficult to manage securely. The problem is no longer lack of tools. It is lack of operational control.”

While this suggests a route toward better usage of firewalls, it doesn’t discuss or explain the fear that contextually incorrect blocking rules might adversely affect business operations – which lies at the heart of improving application security.

The two reports are, however, slightly at odds. The CSA report suggests the problem is a failure of security tools to provide the solutions really necessary, while the FireMon report suggests the tools exist, but are not being properly managed.

https://www.securityweek.com/two-new-reports-offer-competing-explanations-for-cybersecuritys-growing-crisis/

Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities

Google on Monday announced its latest Android update, which includes patches for 124 vulnerabilities, including a zero-day that has been exploited in targeted attacks.

The exploited vulnerability is CVE-2025-48595, which Google describes as a high-severity privilege escalation issue affecting Android’s Framework component.

“There are indications that CVE-2025-48595 may be under limited, targeted exploitation,” Google said in its advisory.

There does not appear to be any information on the attacks exploiting CVE-2025-48595.

However, commercial spyware vendors have become the dominant force behind most zero-day exploits targeting Android devices, developing and selling sophisticated attack chains primarily to government clients. Google’s own researchers are often the ones who discover these exploits.

Of the remaining vulnerabilities patched in the latest Android versions, 18 have been assigned a ‘critical’ severity rating. They affect the framework, system, and Qualcomm closed-source components, and their exploitation can lead to privilege escalation and denial of service (DoS).

Advertisement. Scroll to continue reading.

The other issues have all been rated ‘high severity’. They affect System, Framework, Kernel, and components provided by Imagination Technologies, MediaTek, Unisoc, and Qualcomm.

A majority can be exploited for privilege escalation and DoS attacks, and a few can lead to information disclosure.

Only one of them, a System vulnerability tracked as CVE-2026-0059, can be exploited for remote code execution.

https://www.securityweek.com/android-update-patches-exploited-zero-day-123-other-vulnerabilities/

Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches

A critical-severity vulnerability in multiple HP Poly Voice VoIP phone models can be exploited for remote code execution (RCE) with root privileges, allowing attackers to gain a foothold in enterprise networks, Rapid7 warns.

Tracked as CVE-2026-0826 (CVSS score of 9.2), the bug is described as a stack-based buffer overflow issue in the parsing of Session Description Protocol (SDP) attributes and affects devices that have the Interactive Connectivity Establishment (ICE) feature enabled.

The security defect was identified in a function that parses individual components of candidate attributes. The parsing function is called during the processing of SDP data, when ICE is enabled.

“The candidate attribute is intended to contain a transport address for a candidate that can be used for connectivity checks,” Rapid7 explains.

The parser copies the incoming string line into a 256-byte stack buffer without checking its length, and a candidate attribute with a greater length can be supplied to trigger the buffer overflow.

An attacker can exploit the vulnerability by sending a SIP INVITE request containing a malicious candidate attribute, which will trigger a crash, providing the attacker with control of the program counter, general-purpose registers, and data in the stack pointer.

Advertisement. Scroll to continue reading.

To bypass ASLR and No Execute (NX) mitigations, which prevent the execution of the stack data, the attacker can use a Return Oriented Programming (ROP) chain containing null bytes, which results in arbitrary code execution.

The bug has been confirmed on HP VVX series (VVX 150, VVX 250, VVX 350, and VVX 450) and Trio IP Conference series (Trio 8800, Trio 8500, and Trio 8300) VoIP phones. Patches are available for all of them.

Disabling ICE connectivity where it is not required mitigates the vulnerability. To fully address it, administrators are advised to update Poly Voice devices to a patched firmware release.

According to Rapid7 vulnerability intelligence director Douglas McKee, the main issue is that these devices reside in inherently trusted places, including conference rooms, offices, help desks, and hospital stations.

“A compromise in that context is not just about device access. It’s about what that access enables,” McKee notes, explaining that these devices typically don’t run endpoint protection software and can be abused to establish a persistent foothold into an environment and then intercept transmissions or move laterally.

“A compromised desk phone sitting in an executive office or conference room is not just a way to eavesdrop on sensitive discussions. It can also become a collection point for exactly the kind of audio that can be reused in vishing, deep fakes, social engineering, or even fraudulent financial authorization attempts,” McKee says.

https://www.securityweek.com/critical-vulnerability-in-hp-voip-phones-enables-enterprise-network-breaches/

Oracle WebLogic Vulnerability Exploited in the Wild

CISA is warning organizations that an Oracle WebLogic vulnerability patched nearly two years ago is being exploited in the wild.

The security hole, tracked as CVE-2024-21182, was patched by Oracle in the Java application server with its July 2024 CPU. The software giant’s advisory shows that the flaw was discovered and reported independently by several researchers.

Several proof-of-concept (PoC) exploits targeting CVE-2024-21182 have been made publicly available since the vulnerability’s existence came to light, but CISA appears to be the first to warn about its in-the-wild exploitation.

CISA added CVE-2024-21182 to its Known Exploited Vulnerabilities (KEV) catalog on June 1, instructing federal agencies to address it by June 4.

The flaw can be leveraged by remote, unauthenticated hackers to compromise vulnerable Oracle WebLogic Server instances.

“Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data,” the agency noted in its KEV entry.

Advertisement. Scroll to continue reading.

There does not appear to be any information on attacks exploiting the vulnerability.

CISA’s KEV catalog includes a dozen other WebLogic Server flaws. The majority are vulnerabilities with CVEs assigned in 2020 or earlier, but most were added to the KEV catalog several years after Oracle patched them.

https://www.securityweek.com/oracle-weblogic-vulnerability-exploited-in-the-wild/