Confluence Zero-Day: The In-Memory Implant

An internet-facing Atlassian Confluence server falls to an unauthenticated OGNL-injection zero-day (CVE-2022-26134). Code runs as the confluence service account, which plants a JSP webshell over a legitimate file, loads a memory-resident implant into the JVM, dumps the local database credentials, and wipes the access log before exfiltrating the data. Work the Confluence web logs, the Linux host trail, and the perimeter egress to reconstruct the breach.