A 26 October 2026 engineering post from the InterceptSuite team shows why the HTTP/3 proxy blind spot exists: HTTP/3 runs over QUIC on UDP, so TCP-based proxies such as Burp Suite never receive the packets. There is no CVE and nothing to patch. If your firewall, logs or test tooling only understand TCP, though, part of your HTTPS traffic is passing them by.
Atlassian has disclosed a critical path traversal vulnerability affecting eight of its self-hosted Data Center products, including Jira, Confluence and Bitbucket. Tracked as CVE-2026-21589 with a CVSS score of 9.3, the flaw can allow an unauthenticated party to read certain files from the web application root directory.
Atlassian’s cloud-hosted products have already been fixed. Organizations running their own Data Center instances need to update them.
Attackers are exploiting a now-patched vulnerability in Zimbra Collaboration Suite (ZCS) to deploy web shells and gain access to mailbox data, according to the Microsoft Security Research team.
The flaw, tracked as CVE-2026-73570 (CVSS score: 8.9), is an unauthenticated operating system command injection that can lead to remote code execution. The server is exposed when SNMP notifications are enabled and the optional zimbra-snmp package is installed. An attacker only needs to send a specially crafted SMTP request — in other words, an email — to an internet-facing Zimbra server. No authentication or user interaction is required. Zimbra fixed the issue in July 2026 with version 10.1.20.
CRITICAL SECURITY ALERT: A massive-scale vulnerability affecting React Server Components (CVE-2025-55182) has exposed over 644,000 domains and 165,000 unique IP addresses to potential remote code execution and security bypass attacks. This represents one of the most widespread web application vulnerabilities discovered in 2025, with immediate action required from all organizations using React-based applications.
Read More