Jira

Atlassian October Security Bulletin Flags 176 Third-Party Library Vulnerabilities Across Jira, Confluence and Bitbucket

Atlassian released its October security bulletin detailing 176 vulnerability entries distributed across seven products including Jira, Confluence, Bamboo, Bitbucket, Crowd, Fisheye and Crucible. Of these, 162 entries carry high severity and 14 are rated critical, though the total does not represent 176 unique flaws because the same identifiers recur when multiple products share the same third-party library. All critical issues originate in external components rather than Atlassian code, with the most severe being CVE-2026-65637 in the Coyote component of Apache Tomcat used by Confluence, which allows interception of server-client connections. Affected versions and corresponding fixes were published for Confluence Data Center, Bamboo, Bitbucket Data Center, Jira Software and Jira Service Management, with the company stressing that administrators must compare exact build numbers against the full corrected-version table. No exploitation of the listed issues had been reported as of 22 October, and Atlassian classifies the inherited exposure from third-party libraries as lower priority, issuing separate critical alerts only for immediate-risk cases.

Snowflake GitHub Actions Workflow Flaw Enabled Command Injection and Jira Token Theft

A vulnerability in Snowflake's GitHub Actions workflow in the snowflakedb/snowflake-connector-net repository allowed any user to execute arbitrary commands on a runner by creating a specially crafted issue in a public repository. The flaw stemmed from unsanitized insertion of issue titles and content directly into shell commands, combined with a failed access control check that relied on a non-existent pull request property during issue events. During authorized testing, an autonomous security agent exploited the issue to extract a Jira API token from the pipeline environment variables. This credential granted read access to internal engineering, security compliance, and bug bounty projects. The vulnerability was active from June 18 to June 23, 2026. Snowflake patched the workflow on the day the report was received and rotated the compromised token the following day. The vulnerable code appeared in a pull request that involved GitHub Copilot, though available history does not confirm the AI generated the insecure lines.

VK Introduces Security Gate: Internal AppSec Platform for Code, Dependency and Container Security

VK has detailed its internal Security Gate platform, which combines SAST, SCA, secret detection and container scanning to identify security issues across more than 40,000 repositories. The system applies custom prioritization rules, dynamic metadata analysis and an LLM-based triage module called VK Triage to reduce false positives and focus developer attention on exploitable findings. Security Gate integrates directly with corporate GitLab for automatic project onboarding, badge reporting and merge-request checks via the Fast Scanner service. It also monitors open-source dependencies for protestware, malware and reachable vulnerable methods, while supporting a wide range of languages including Python, Go, Java and Swift. Additional features include Jira linking, cross-branch triage, SBOM export and automated alerts through VK WorkSpace bots.

Anthropic Launches Claude Security Plugin to Let Claude Review Its Own Code in Terminal Workflow

Anthropic has released the Claude Security plugin in beta, embedding it directly into the Claude Code terminal workflow so developers can scan uncommitted changes or run full repository scans without switching tools. The plugin uses a multi-agent system that reads code, maps architecture, identifies potential threats, and verifies findings to reduce false positives before suggesting style-matched patches. Unlike traditional rule-based scanners, it focuses on cross-file logic issues, memory corruption, injection flaws, authentication bypasses, and complex business logic errors by analyzing Git history and data flows. Early users praise the verification step that builds trust, though Anthropic provides no public false-positive or false-negative statistics yet. The tool deliberately avoids automatic commits, requiring human review for every fix, and integrates with Slack, Jira, CSV, and Markdown exports for existing security workflows. Costs can rise with large scans due to token usage, making incremental or directory-limited scans more practical for teams. Overall, the release represents an effort to add researcher-level AI analysis into daily development cycles as a supplement rather than a replacement for SAST, DAST, or human security teams.