Critical Atlassian CVE Hits Jira, Confluence & Bitbucket, GitHub Copilot Sandboxing Goes GA, AWS Lambda SnapStart for Containers & Google Spanner Omni

First up, Atlassian disclosed CVE-2026-21589.

This is a critical arbitrary file access vulnerability with a CVSS score of 9.3. And it affects a pretty big chunk of the Atlassian stack.

Bitbucket Data Center, Confluence Data Center, Jira Software, and Jira Service Management Data Center.

Bamboo, Crowd, Crucible, and FishEye.

An unauthenticated attacker can access specific files inside the web application root directory.

There is an important limitation here.

the attacker needs to know the exact file name and path.

They cannot use this to just list the directory and start browsing around.

But that does not make this something I would sit on.

There are extremely common enterprise systems and depending on the product and configuration, files under the web root can contain information you really do not want somebody pulling remotely.

Atlassian says that affected data center installations require immediate attention.

Cloud customers have already been patched.

And Atlassian says it has not found evidence of exploitation.

The thing I would keep in mind here is that we sometimes treat developer tooling as somehow separate from production infrastructure.

It is not.

Your source code is in there.

Your tickets are in there.

Your internal documentation is in there.

Your CI system might be in there.

Your deployment information might be in there.

Compromise the tooling engineers use to build and operate production is and the blast radius can get pretty big quickly.

If you run any of the affected self-managed Elastium products, check the fixed versions and get them patched.

First up, Atlassian disclosed CVE-2026-21589.

This is a critical arbitrary file access vulnerability with a CVSS score of 9.3. And it affects a pretty big chunk of the Atlassian stack.

Bitbucket Data Center, Confluence Data Center, Jira Software, and Jira Service Management Data Center.

Bamboo, Crowd, Crucible, and FishEye.

An unauthenticated attacker can access specific files inside the web application root directory.

There is an important limitation here.

the attacker needs to know the exact file name and path.

They cannot use this to just list the directory and start browsing around.

But that does not make this something I would sit on.

There are extremely common enterprise systems and depending on the product and configuration, files under the web root can contain information you really do not want somebody pulling remotely.

Atlassian says that affected data center installations require immediate attention.

Cloud customers have already been patched.

And Atlassian says it has not found evidence of exploitation.

The thing I would keep in mind here is that we sometimes treat developer tooling as somehow separate from production infrastructure.

It is not.

Your source code is in there.

Your tickets are in there.

Your internal documentation is in there.

Your CI system might be in there.

Your deployment information might be in there.

Compromise the tooling engineers use to build and operate production is and the blast radius can get pretty big quickly.

If you run any of the affected self-managed Elastium products, check the fixed versions and get them patched.