Monday, October 5, 2026 · Daily editionBack issueBack issues · Search

SitRep

An independent cybersecurity briefing — what matters, with its sources.

You are reading a back issue. Go to the latest edition →

The situation

Denmark CPR Breach Exposes 8.8 Million

Denmark's CPR breach exposes 8.8 million records; review supplier access and patch exploited appliances.

Composed by SitRep’s AI editors from 4 sources — BleepingComputer, SecurityWeek, The Hacker News, Help Net Security

Denmark CPR Breach Exposes 8.8 Million Records

BleepingComputer reports the Central Population Register breach exposed about 8.8 million records—roughly 80% of the 11 million registry—after attackers leveraged a private vendor’s legitimate access and brute-forced identifiers. Police are investigating and authorities enacted emergency mitigations; organizations handling identity data should assume large-scale harvesting of identifiers.

Context

This incident highlights a two-track risk: mass data exposure alongside exploitation of exposed appliances and single-service servers to gain initial access and pivot to identity stores. Practitioners must treat appliance and vendor-access CVEs as enterprise-wide risk, with IR, identity, and asset owners coordinating now to limit pivot paths.

“Defenders must patch, review access, and hunt for indicators of compromise now.”
The move

5 things to do today

  1. Patch Citrix NetScaler for CVE-2026-88779 on 14.1 and 13.1 branches and enable Global Deny List signatures before Oct 7.
  2. Upgrade Rejetto HFS to 3.2.1; hunt for forged admin sessions and webshells linked to China Telecom IPs.
  3. Apply Microsoft Exchange patch for CVE-2026-96940 across on‑premises; audit mailbox access logs for anomalies.
  4. Rotate vendor credentials and enforce MFA for third-party access; review supplier activity and IAM logs.
  5. Block and monitor STUN/ICE egress; hunt for ClingSTUN patterns and patch exposed vendor devices listed in exploit chains.

On the wire

P0Breach

Denmark CPR Breach Exposed Roughly 8.8 Million Records

The Central Population Register leak exposed ~8.8 million records (~80% of the registry) after attackers abused a vendor’s access and brute-forced identifiers. Immediately treat all identity‑matching stores and vendor accounts as compromised: rotate credentials, require MFA for vendor access, and begin log collection/hunt for exfiltration indicators.

BLEEPINGCOMPUTER · Denmark Population Registry Breach Impacts 8.8 Million People

P0Exploit

CISA Adds Citrix NetScaler CVE-2026-88779 to KEV — Federal Deadline Oct 7

CVE-2026-88779 is a memory overflow in Citrix NetScaler ADC/Gateway when SAML is used; CISA placed it on KEV with Oct 7 remediation. Patch 14.1 before 14.1-73.41 and 13.1 before 13.1-64.28, deploy Global Deny List signatures, and hunt for webshells and abnormal inbound SAML traffic.

HELP NET SECURITY · CISA Flags Exploited NetScaler Flaw CVE-2026-88779

P1Exploit

Rejetto HFS CVE-2026-61500 Exploited to Forge Admin Cookies and Achieve RCE

CVE-2026-61500 leaks session‑cookie generator outputs allowing forged admin cookies and RCE in HFS 3.0.0–3.2.0; upgrade to 3.2.1, inspect logs for forged admin sessions, and hunt for webshells tied to China Telecom IPs.

SECURITYWEEK · Exploitation Hits Rejetto HFS Vulnerability Discovered by AI

P1Patch

Microsoft Exchange CVE-2026-96940 Out-of-band Patch for Mailbox Read Elevation

Microsoft released an out-of-band update for CVE-2026-96940 (CVSS 8.8) enabling authenticated read access to mailboxes; patch on-premises now and verify Exchange Online status.

THE HACKER NEWS · Microsoft Exchange Flaw Lets Authenticated Attackers Read Mailboxes

P2Malware

ClingSTUN Backdoor Uses STUN for back‑connect Proxying and Propagation

ClingSTUN abuses STUN to discover NAT mappings, establish back‑connect proxies, and propagate via multiple vendor exploits; block or inspect STUN/ICE traffic and hunt for unusual outbound STUN sessions on Linux hosts.

SECURITYWEEK · Linux Backdoor ClingSTUN Abuses STUN Protocol

Indicators named in this edition

KindValueNote
CVECVE-2026-61500Rejetto HFS session‑cookie forgery and RCE
CVECVE-2026-88779Citrix NetScaler memory overflow (KEV)
CVECVE-2026-96940Microsoft Exchange mailbox read elevation

Elsewhere in the edition

Google Narrows Open Source Bug Bounty Amid AI Submissions Wave

Google paused the Open Source Software Vulnerability Reward Program (OSS VRP) for product vulnerabilities due to a surge of automated, mostly invalid submissions. Cloud VRP may still accept some reports; no impact on supply chain or pending reports. Update promised for Q1 2027. May changes to Chrome and Android reward programs included lowering Chrome payouts and boosting Pixel Titan M rewards to…

4 reports

Alleged ShinyHunters Leader Arrested in Jordan

The alleged ShinyHunters leader, Saif ‌al-Din Khader (aka Rey) from Amman, was arrested in Jordan and is cooperating with the FBI to identify other members. He helped link the group to the FBIJobs[.]gov hack, which exposed 2–3 TB of data. The FBI says the investigation has involved arrests in the Netherlands (Pepijn van der Stap), with across 140+ organizations hacked and at least $70 million in…

2 reports

Milk Dragon Phishing Campaign Abuses Social Media Channels

Milk Dragon phishing kit creates spoofed e-commerce sites and fake listings on Facebook and TikTok to steal payment data. It targets 66 countries, spoofing 21 brands including Lego and Calvin Klein. BytePress malware streams keystrokes in real time, defeating MFA. Victims see fake order confirmations. Telegram-based service sells the kit for ~300 USDT/month.

2 reports

Also reported

End of the Monday, October 5, 2026 edition.