Week in Review: Self-Signing Worms, Atlassian, Fake Google Certs Artwork

The Matthew Chapman Podcast

Join Matthew Chapman, a Cybersecurity Expert with over 30 years of experience architecting solutions for some of the world’s largest organizations. Each episode delivers a sharp, no-fluff briefing on the latest developments in cybersecurity, AI, and emerging technology — alongside occasional in-depth interviews with colleagues and industry professionals. Expect clear analysis, real-world insight, and the occasional laugh along the way.

All Episodes

The Matthew Chapman Podcast

Week in Review: Self-Signing Worms, Atlassian, Fake Google Certs

October 09, 2026

0:00 | 3:34

Week in review: the three stories from this week that still need your attention, a self-signing supply-chain worm, an Atlassian bug turned admin factory, and real TLS certificates minted through hijacked country domains.

1. Shai-Hulud worm rides Tensorlake into Claude Code and VS Code

tensorlake 0.5.144 on npm shipped a preinstall credential stealer that republishes victims' packages with Sigstore provenance and plants persistence in .claude and .vscode task files. Revoking the stolen GitHub token first may trigger a destructive payload.

Before the weekend: search repos for unexpected .claude and .vscode task files, clean the machine, then rotate npm, GitHub, and cloud tokens.

Source: The Hacker News

2. Atlassian Data Center flaw went from advisory to attacks in two hours

A 9.3 path traversal in eight self-hosted Data Center products, including Jira, Confluence, Bitbucket, Bamboo, and Crowd, is under exploitation; on Crowd and Jira it leads to admin takeover via crowd.properties. Fix versions differ between the advisory and the CVE record.

CVE: CVE-2026-21589

Before the weekend: upgrade to the fixed release, confirm the build number, and audit for unknown admin accounts.

Sources: The Hacker News (disclosure), The Hacker News (exploitation)

3. Hijacked .gh, .sl, and .as domains produced real certificates for Google

Attackers took over three ccTLDs, rewrote DNS beneath them, and got CAs to issue TLS certificates for Google and other major brands. Chrome blocks the known certificates, but Google can't promise it found them all, and other browsers aren't covered.

Before the weekend: set restrictive CAA records and subscribe to certificate transparency alerts for your domains.

Source: The Hacker News

More from Matt: https://www.mattchapman.net

Kindle: https://www.amazon.com/dp/B0HHMH88H9
Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472

Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764

https://mattch

Support the show

Friday Security Briefing Opens

SPEAKER_00 0:10

Here is your briefing for Friday, October 9th, 2026.

Self-Spreading Worm Hits Dev Tools

SPEAKER_00 0:15

This week, a self-spreading worm learned to sign its own packages and hide inside your AI coding tools, and it's probably still sitting in a repo near you.

Preinstall Hook Steals Credentials

SPEAKER_00 0:31

Version 0.5.144 of the TensorLake TypeScript SDK, shipped with a pre-install hook that drops a bun-based credential stealer. It grabs secrets from local files, CI, Kubernetes, and Vault, then republishes every package the victim can touch, complete with SIG store attestations that look perfectly legitimate.

Cleanup Risks And Persistence

SPEAKER_00 0:49

What's still unresolved is the cleanup. The worm plants.claud settings and.viscasty task files in any repo it reaches, so it reruns the next time someone opens the project, and a watchdog may fire a destructive payload if you revoke the stolen GitHub token first.

Weekend Checklist For Repos

SPEAKER_00 1:04

Signed doesn't mean safe anymore. Before the weekend, search every repo for unexpected.claud and .viscast task files, clean the machine, then rotate npm, github, and cloud tokens. Number

Atlassian Data Center Exploitation

SPEAKER_00 1:19

two, Atlassian's data center flaw is now being exploited. CVE 2026-21589 is a 9.3 path traversal across eight self-hosted products: Jira, Confluence, Bitbucket, Bamboo, and Crowd. Among them, on Monday it looked limited because an attacker needed the exact file path. By Wednesday, Watch Tor had published details and Honeypot saw attacks within two hours. The catch is that the file path is well known. On Crowd and Jira, attackers pull the crowd.properties file, use the credentials inside to get admin, and mint a fresh Jira administrator. Cloud is fixed. A nuclei template is public and every unpatched internet-facing instance is a target, made worse by fixed versions that don't quite match between the advisory and the CVE

Patch Verify Builds Audit Admins

SPEAKER_00 2:06

record. Before the weekend, upgrade self-hosted Atlassian to the fixed release, confirm the build number, and audit for admin accounts nobody created.

DNS Hijack Triggers Bad TLS Certs

SPEAKER_00 2:17

Number three, someone owned the phone book. Google says attackers hijacked the.gh, dot sl, and.as country code domains, rewrote DNS for chosen names underneath them, and used that control to pass automated validation. So real certificate authorities issued TLS certificates for Google Domains and several other global brands. Chrome blocks the certificates Google found and Google's own were revoked. Still unresolved, Google admits it can't promise it found them all, and Chrome's block does nothing for Firefox, Safari, or the ancient Java client in your data center. Before

Lock Down CAA Watch Cert Logs

SPEAKER_00 2:51

the weekend, set restrictive CAA records on your domains and subscribe to certificate transparency alerts for anything issued that you didn't request.

Closing Reminder To Patch

SPEAKER_00 3:20

That's the briefing. Stay sharp, keep your systems patched, and we'll see you Monday.