SANS Internet Storm Center Stormcast: Multiple Critical Vulnerabilities and Security Incidents

The SANS Internet Storm Center Stormcast for October 8, 2026 covers multiple cybersecurity vulnerabilities and incidents. Atlassian published patches on October 5th for a vulnerability affecting Jira, Bitbucket, and Confluence products that allows directory traversal attacks through URL manipulation where two colons are replaced with a slash, enabling attackers to read arbitrary files within the application directory. Watchtower released a detailed write-up with proof of concept exploit strings that are now appearing in honeypot logs. The DNS registrar for country-level domains GH, SL, and AS (Ghana, Sierra Leone, and American Samoa) was compromised, allowing attackers to obtain fraudulent TLS certificates for domains including local Google sites, which Google Chrome subsequently added to its block list. Cisco released updates addressing nine vulnerabilities in Nexus switches and NXOS, including critical remote code execution flaws affecting the OAM feature for VXLAN and MLS that require no authentication. Microsoft blocked two additional file extensions from Outlook downloads: MSIX and MSIX bundle, both associated with install packages.