Three just-disclosed remote code execution (RCE) security vulnerabilities open up Atlassian Confluence Data Center & Server, and Bamboo, to system takeover, the software company is warning.

Confluence is a popular Web-based corporate wiki used for collaboration in cloud and hybrid server environments that allows one-click connections to a variety of different databases. More than 60,000 customers use Confluence, including LinkedIn, NASA, and the New York Times.

Bamboo, meanwhile, is a continuous integration (CI) and continuous delivery (CD) server for software development that provides automated building and testing of software source-code status.

Successful exploitation of any of the flaws could offer a wide-open door into users' cloud infrastructure, software supply chain, and more. While threat actors need to be authenticated to be successful, no user interaction is required to exploit the bugs.

In Confluence, the vulnerabilities are tracked as CVE-2023-22505 (CVSS 8.5) and CVE-2023-22508 (CVSS 8.0). Both were patched in Confluence versions 8.3.2 and 8.4.0.

"This injection and RCE vulnerability allow an authenticated attacker to modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability,” Atlassian noted in its security advisory on Confluence.

Meanwhile, the high-severity issue in the Bamboo Data Center (CVE-2023-22506, CVSS 7.5) was patched in versions 9.2.3 and 9.3.1.

"[An attacker can] modify the actions taken by a system call and execute arbitrary code which has high impact to confidentiality, high impact to integrity, high impact to availability," according to Atlassian. 

Given the sensitive nature of Atlassian within corporate networks, the US Cybersecurity and Infrastructure Security Agency (CISA) is urging that users apply the patches to their Atlassian instances as soon as possible.

© 2023 Benzinga.com. Benzinga does not provide investment advice. All rights reserved.

(Bloomberg) -- Atlassian Corp. rallied 19% after delivering a forecast for the new year that quelled investor anxieties over a slowdown in internet technology spending.

Most Read from Bloomberg

Cloud revenue will grow in the fiscal year ending June 2024 by 25% to 30%, the collaboration software company said Thursday in a statement. That’s in line with an average of estimates compiled by Bloomberg.

“We closed out a challenging year with strong momentum in cloud migrations,” Co-Chief Executive Officer Scott Farquhar said in the statement.

Analysts had expressed caution about the durability of Atlassian’s cloud growth in the lead up to earnings. Atlassian faced “a wall of worry about the macro, the guidance, the margin, basically everything,” wrote Alex Zukin, an analyst at Wolfe Research. After strong results, “the script has been completely flipped,” he said.

The stock jump Friday morning was the largest intraday increase in two years. Through Thursday’s close, the stock had gained 32%, which is short of the 37% rally in the iShares Expanded Tech-Software Sector ETF. Like many peers, Atlassian has introduced new artificial intelligence features into its line of products this year, which includes Jira and Confluence.

In the fiscal fourth quarter, revenue increased 24% to $939 million, slightly exceeding analyst estimates. Profit, excluding some items, was 57 cents a share. Analysts, on average, projected 45 cents. “The strong execution on costs should be viewed positively,” wrote Bloomberg Intelligence analyst Sunil Rajgopal.

There are still indicators that software spending is under pressure. New customer additions came in significantly under expectations at 2,562, less than half of what analysts expected. The cloud revenue guidance assumes macroeconomic headwinds persist into the new fiscal year, said Chief Financial Officer Joe Binz during the earnings call Thursday.

Story continues

Still, the sale of new licenses appeared to pick back up again toward the end of the quarter, “offering some hope that we may be close to a bottom in terms of macro headwinds,” wrote William Blair analyst Arjun Bhatia.

(Updates with shares and additional reporting starting in the first paragraph.)

Most Read from Bloomberg Businessweek

©2023 Bloomberg L.P.

In a letter to shareholders, Mr Farquhar and Mr Cannon-Brookes reiterated their promise to investors to Strengthen margins in the 2025 financial year, after sacking 500 staff, introducing tougher employee performance metrics and restructuring its engineering organisation.

“We aren’t afraid to make tough tradeoffs in support of durable growth that others shy away from, even when it may be uncomfortable in the short term,” the co-founders wrote.

Following the announcement, Atlassian’s shares climbed to $US213.70 in extended trading after closing at $169.65 in New York. Before Friday morning’s rally, Atlassian’s shares had risen 33 per cent so far this year, and remain 27 per cent lower than a year ago.

The company now has more than 250,000 customers, adding 20,000 customers during the fiscal year, although it said free users were taking longer to convert to paid accounts due to macroeconomic conditions.

During the period, Atlassian migrated millions of users to the cloud, helping lift cloud revenue to more than $US2 billion.

Earlier this year Atlassian also introduced new generative artificial intelligence features to its software which is only available through its cloud products, which is accelerating customers’ cloud migrations, the company said.

The virtual assistant, dubbed Atlassian Intelligence, draws on OpenAI’s latest advancements in large language models and Atlassian customers’ unique data.

“We can enhance generic AI answers with contextual information on a per-customer basis. The result is exceptionally useful output, tailored to each customer’s unique knowledge base and organisational structures,” the co-CEOs wrote.

Unlike Microsoft or GitLab, Atlassian has not set pricing for its AI features. Mr Cannon-Brookes said Atlassian was focused on developing the products and getting more customers to use them before thinking about monetisation.

“Our philosophy is to lead with R&D to build and then customer value before thinking about monetisation. I know there may be others in the industry who go the other way around,” Mr Cannon-Brookes said.

“Those [Atlassian AI] features are now in the hands of the order of thousands of customers, and we are working every single day to make sure that those features deliver customer value and actually used first.”

The company is forecasting a 25 to 30 per cent growth in its cloud revenue in FY24 and revenue between $US950 million and $US970 million in the first quarter.

Three years after moving to a remote-first model, Atlassian said over half of the people it hired in FY23 live more than two hours away from an office. The company said it had continued to benefit from wider tech layoffs, by picking up specialised talent.

On average, 67 per cent of Atlassian’s 10,000-strong global workforce comes to the office at least once a quarter.

The company also announced that its chief revenue officer, Cameron Deatsch will leave the business in December, after almost 11 years with Atlassian.

The government should focus its attention on harms actually being done by AI, and an AI singularity wiping out the world “is a future, speculative risk”, Ms Jaffe told The Australian Financial Review.

In any case, Atlassian did not intend to play traffic cop itself, she said, but would leave assigning the colours up to others, such as one or more advisory boards that could be set up to help the government prioritise and draw up regulations.

“Green” would be for uses of AI that are already well covered by existing laws, where the public might only need better education to “build and maintain public trust in safe and responsible AI.

“There’s this real perception out there that our current legal frameworks aren’t suited to AI: they’re not ready, they can’t keep up. We think that perception isn’t true. There are many ways in which our frameworks are fit for purpose, or could be made fit for purpose,” she said.

In its submission to the government inquiry, the tech giant Google called for an overhaul of Australia’s Copyright Act, to make it easier for AI companies such as Google to train their machine learning models on copyright-protected content they do not have legal rights to.

Google also asked for changes to Australia’s competition law that would create a safe harbour for AI researchers to collaborate with each other across industries, in ways that would normally be deemed anticompetitive.

“We’d have to see the case made” for those sorts of carve-outs for tech companies,” Ms Jaffe said.

“If there is some sort of blocker that can be identified under an existing law, then maybe [carve-outs] should be looked at. But I’m not sure I can see where that arises under our current framework,” she said.

Atlassian is working with the company behind ChatGPT, OpenAI, to develop its own AI software.

The software, known as Atlassian Intelligence, works inside tools such as Atlassian’s Jira issue-tracking platform to quickly generate responses to problems, or to summarise long discussions.

CNN  — 

The Biden administration on Thursday announced further steps to lower housing costs and boost supply, part of the economic agenda that President Joe Biden will highlight as he seeks a second term.

The administration is taking a “comprehensive federal approach,” White House domestic policy adviser Neera Tanden told reporters, toward improving affordability for both homeowners and renters. The newly announced plan will leverage three separate areas toward achieving this goal: Easing land use and zoning rules, expanding financing and promoting the conversion of commercial to residential space.

As office space needs have shifted in the aftermath of the pandemic, the administration is incentivizing efforts to convert commercial properties to residential homes.

“Our work will involve identifying areas and methods where federal funding, including climate-focused federal resources, can be used to support these conversions,” Biden economic adviser Daniel Hornung said, pointing to funding from the Inflation Reduction Act’s Greenhouse Gas Reduction Fund as one such funding mechanism.

Additionally, he said, “The General Services Administration, which manages much of the federal footprint of buildings, will launch an effort to identify and market surplus federal properties that represent the best opportunities for commercial to residential conversions.”

To address restrictive land use and zoning policies – including those that prohibit multifamily housing development, among other issues, the administration is looking to incentivize municipalities to lift some of those restrictions by “incorporating land use and zoning into the grant criteria for the historic Reconnecting Communities and Neighborhoods program and also into the Economic Development Administration’s grant programs,” said Hornung.

Additionally, the Department of Housing and Urban Development (HUD) is announcing a new program, the Pathways to Removing Obstacles to Housing program, which will provide communities with $85 million in funding to “identify and remove barriers to affordable housing production and preservation.”

On financing, the administration is rolling out a $27 billion fund via the Environmental Protection Agency for energy efficient and climate resilient housing. There are also new underwriting guidelines for Federal Housing Administration, a streamlining of other low-income HUD financing programs, and increasing financing for onsite housing units.

The administration is also announcing actions aimed at protecting renters, which comprise roughly 35% of the US population, per a White House fact sheet.

Government entities involved with housing are releasing guidance and best practices to landlords and operators regarding tenant screening reports and giving tenants an opportunity to correct errors in those reports. HUD will also unveil $10 million in tenant education and outreach funding. And there are a series of rulemaking efforts underway to deliver more time to tenants to avoid eviction.