Skip to content
TrustList

TrustList daily digest · Tech and security

Tuesday, 6 October 2026

Tech and security: the stories TrustList published on this day, each in a line of our own. Open a story for the whole piece and its sources.

Tech and security8

  1. 1Security advisories

    Atlassian fixes critical file-read flaw in its Data Center products

    CVE-2026-21589 scores 9.3 and needs no login. Every self-managed Jira, Confluence, Bitbucket, Bamboo and Crowd version below the fixed releases is exposed; Cloud was patched first.

  2. 2Security advisories

    LibreOffice and OpenOffice patch Java code-execution flaw

    A crafted spreadsheet can load remote Java code with no macro prompt when Java support is on. A proof of concept is public, and the Apache fix is still in release candidate.

  3. 3Security advisories

    WordPress 7.1.3 fixes seven flaws, including SQL injection in export

    The release also carries four bug fixes. Security backports to older branches, reaching back to 4.7, are still in progress and will ship as each becomes ready.

  4. 4Security advisories

    Exchange Server flaw lets a signed-in user read colleagues' mailboxes

    Microsoft's second September update for on-premises Exchange fixes CVE-2026-96940 (CVSS 8.8). Exchange 2016 and 2019 servers only get it through paid extended support.

  5. 5Security advisories

    Elastic patches 14 flaws across Elasticsearch, Kibana and Endpoint

    Three are rated High, led by a Kibana Fleet flaw scoring 8.8 that lets a delegated user redirect another team data stream. Several older release lines get no fix at all.

  6. 6Security advisories

    Italy's CSIRT finds Zimbra servers hit by ransomware and miners

    Most intrusions trace to CVE-2026-73570 on servers with the optional SNMP package. In one case more than 6,000 mailboxes were down for 48 hours, and patched servers were not breached.

  7. 7Security advisories

    Apache fixes four Struts flaws, one of them OGNL code execution

    Italy's national cyber agency rates three of the four as high severity and tells users to update; Apache itself rates the code-execution bug only Moderate and limits it to one mapper.

  8. 8Security advisories

    GROWI wiki before 7.5.5 lets anyone read files on private pages

    Only installations that store uploads locally are exposed. JPCERT/CC rates the flaw 6.9 on the CVSS 4.0 scale, and the vendor has released version 7.5.5 with the fix.

TrustList Weekly

The week in software and IT, in one email

The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.

We will email you to confirm. Unsubscribe with one click in any issue. Privacy policy