Daily Brief
certificate abuse and active Atlassian exploitation
Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
Attackers compromised three ccTLD registries and obtained unauthorised HTTPS certificates for several Google domains, affecting .gh, .sl and .as. Google says its own systems were not breached, but the incident shows how registry compromise can undermine trust in encrypted traffic.
Review external certificate issuance and DNS change monitoring for your domains, including ccTLD dependencies, and alert on unexpected certificate activity.
Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
Threat actors began exploiting Atlassian Data Center flaw CVE-2026-21589 within two hours of public details. The issue can allow arbitrary file access in products including Jira, Confluence and Bitbucket, so internet-facing instances need rapid patching and exposure review.
Identify all self-hosted Atlassian Data Center systems, confirm patch status for CVE-2026-21589, and restrict internet exposure until fixed.