Bitbucket

Atlassian's Data Center products — Bitbucket, Confluence and Jira — are affected by CVE-2026-21589, a critical vulnerability (CVSS 9.3) allowing unauthenticated arbitrary file access. Security researchers report exploitation attempts began within two hours of public proof-of-concept details being released, making rapid patching urgent for organizations running affected software.

Security researchers are flagging CVE-2026-21589, a critical vulnerability in self-hosted Atlassian Data Center products including Jira, Confluence, Bitbucket, Bamboo and Crowd. The flaw allows unauthenticated attackers to access arbitrary files, though they must know the exact file name or path since directory listing is not possible. Atlassian has released patched versions and reports no known exploitation so far. Administrators are urged to update their deployments promptly.

Atlassian has a critical vulnerability, tracked as EUVD-2026-92807, affecting a range of its enterprise products including Bitbucket Data Center, Crowd Server, Crucible Data Center, Confluence Data Center and Jira Service Management. The flaw carries a CVSS v3.1 severity score of 9.3 out of 10, putting it in the critical range. The advisory was updated on 5 October 2026, and security teams are being urged to check whether their deployments of the affected Atlassian products are exposed.

A critical vulnerability, CVE-2026-21589 with a CVSS score of 9.3, allows unauthenticated file reads in eight self-hosted Atlassian Data Center products, including Bitbucket, Confluence and Jira. Attackers must know a file's exact name or path, as there is no directory listing. Fixed versions have been released, and security experts urge administrators to restrict public access until they upgrade.

Atlassian has disclosed CVE-2026-21589, a critical arbitrary file-access vulnerability affecting self-hosted Data Center versions of Confluence, Jira and Bitbucket. The flaw could let attackers read sensitive files on affected servers. Atlassian is urging administrators to patch immediately. Security commentators are sharing the advisory and warning self-hosted deployments to act quickly.

Git 3.0 will move from the aging SHA-1 hashing algorithm to SHA-256, a change with implications for repositories, tooling and workflows across the software industry. The news is being discussed alongside developers sharing experiences migrating legacy code services, such as moving from Bitbucket Server to GitHub, and at least one Git co-creator has weighed in on the decision. Developers are debating how disruptive the transition will be for existing repositories.