A third Citrix NetScaler zero-day in a week and a mass Danish population-register breach lead the day, alongside a new AI-named IoT botnet, an out-of-band Exchange fix, and a run of AI policy and data-handling news.
🔴 CRITICAL (2)
Citrix patches NetScaler ADC and Gateway zero-day exploited in the wild (CVE-2026-88779) Confirmed
Citrix released emergency updates for CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway that has been exploited in targeted zero-day attacks and can knock SAML authentication deployments offline. The flaw appeared only days after two other NetScaler flaws exploited in the wild were patched, and CISA added it to the Known Exploited Vulnerabilities catalog on 4 October. Researchers are still checking whether it can also be used for remote code execution, so administrators should patch now and review appliances for signs of compromise.
Denmark's Central Population Register breached, records of 8.8 million people exposed Under investigation
Denmark’s Central Population Register (CPR) disclosed that names, addresses and CPR identity numbers tied to about 8.8 million records were exposed after a private company’s access to the register was misused over roughly ten days. The figure covers living residents, people who have moved abroad and deceased individuals, so it does not represent 8.8 million current residents. Danish authorities are investigating, and people covered by the register should be alert to identity fraud and phishing that reuses leaked identity details.
Sources BleepingComputer|CyberSecurityNews
🟠 HIGH (6)
Seven South Korean financial firms breached in suspected AI-driven campaign Under investigation
South Korea’s Financial Services Commission held an emergency meeting and the President ordered a national investigation after breaches at seven financial institutions, including Shinhan, KB Kookmin and Hana Bank, exposed information on more than 67,000 people. Reporting says the campaign used an open-source AI-powered attack tool to automate intrusion and data extraction. Regulators have ordered sector-wide security audits while the investigation continues.
Microsoft issues out-of-band Exchange Server fix for mailbox access flaw (CVE-2026-96940) Confirmed
Microsoft released out-of-band updates for a high-severity weak-authorisation flaw in on-premises Exchange Server, tracked as CVE-2026-96940 and rated 8.8. An authenticated attacker can abuse it to elevate privileges and read other users’ mailboxes. On-premises Exchange administrators should apply the updates promptly; exploitation in the wild has not been confirmed.
Cling IoT botnet hides command traffic in STUN and spreads via Realtek SDK flaws Confirmed
Nozomi Networks detailed a Linux IoT botnet named Cling that abuses public STUN servers, the same NAT-traversal protocol used by WebRTC and VoIP, so its command-and-control traffic looks like ordinary network noise. It spreads by exploiting known device flaws, including a four-year-old Realtek Jungle SDK bug, and SecurityWeek reports it carries exploits for two dozen flaws to self-propagate. Patching internet-facing routers, cameras and DVRs and cutting unnecessary exposure reduces the risk.
Sources Nozomi Networks|The Hacker News|SecurityWeek|DarkReading
Attackers scan for Rejetto HTTP File Server flaw allowing session forgery and RCE (CVE-2026-61500) Confirmed
VulnCheck reports active scanning and exploitation attempts against CVE-2026-61500, a CVSS 9.3 weakness in Rejetto HTTP File Server. The flaw comes from a weak pseudo-random number generator that lets an attacker recover the session-cookie signing key, forge an admin session and run code. Discovery was assisted by AI and a patch is available, so HFS operators should update exposed servers immediately.
Dell patches critical System Update path traversal that yields root (CVE-2026-86360) Confirmed
Dell warned customers to patch a critical path traversal flaw in the Dell System Update (DSU) command-line tool, tracked as CVE-2026-86360 and rated 9.6. An unauthenticated remote attacker could reach files outside the intended directory and then execute code with root privileges. The bug is fixed in DSU 2.3.0.0 and Dell advises updating without delay.
Sources BleepingComputer|Dell
China-aligned TA419 phishes US AI policy experts with adversary-in-the-middle attacks Confirmed
A China-nexus group tracked as TA419 has run credential phishing campaigns against AI policy experts at US think tanks, universities and legal organisations, impersonating prominent economists, AI policymakers and an Anthropic employee. The campaigns use Microsoft adversary-in-the-middle techniques to capture credentials and session tokens. Targeted organisations should move to phishing-resistant MFA and review identity and mail logs.
Sources The Hacker News|DarkReading
🟡 MEDIUM (4)
Alleged ShinyHunters leader arrested in Jordan and assisting the FBI Under investigation
A suspect known as Rey, described as a leader of the ShinyHunters extortion group, has been arrested in Jordan and is reportedly helping the FBI identify other members. ShinyHunters has run pay-or-leak campaigns across healthcare, insurance and entertainment. The investigation is ongoing and no court outcome has been reported.
Sources SecurityWeek
Clover Health and AngMar breaches affect around 250,000 people Confirmed
Clover Health Investments and AngMar Management Services disclosed breaches in which attackers stole patient information in July, together affecting around 250,000 people. Healthcare remains one of the most targeted sectors, and the two cases add to a year of large medical data theft in the United States. Affected patients should watch for medical and identity fraud.
Sources SecurityWeek
Near Intents recovers $3.8 million drain after 48-hour ultimatum to attacker Confirmed
Near Intents said the roughly $3.8 million drained from its protocol on Thursday was returned in full, one day after the team claimed to identify the attacker and gave them 48 hours to return the funds. The recovery follows a familiar pattern of exploiters handing back crypto after on-chain tracing and public pressure. The project has not published full technical details of the exploit.
Sources Decrypt
US court appearance for alleged developer of Ploutus ATM malware Confirmed
The US Department of Justice announced the arrest of the alleged developer of Ploutus, malware used in ATM jackpotting attacks that stole millions of dollars across the United States. The suspect has appeared in a US court. The case highlights that ATM cash-out crime still depends on purpose-built malware and physical access.
Sources BleepingComputer
⚪ WATCH (6)
Google pauses Open Source VRP submissions after flood of AI-generated reports Confirmed
Google has temporarily stopped accepting product vulnerability reports through its Open Source Software Vulnerability Reward Program after a surge of AI-generated, low-quality submissions. The pause is a sign that automated bug reports are straining triage teams, and Google says it will reopen the program with tighter rules. Vulnerability researchers relying on the program should watch for the new terms.
Sources SecurityWeek|BleepingComputer
OpenAI outlines text watermarking plan for EU content provenance rules Confirmed
OpenAI published its approach to text watermarking under EU AI content provenance rules, covering where watermarks apply, how detection works and why access starts with researchers. The step reflects growing regulatory pressure on AI vendors to label generated content. The practical reliability of text watermarks and who can verify them remain open questions.
Sources OpenAI|BleepingComputer
Apple tightens macOS Full Disk Access controls over AI agent data access Confirmed
Apple said it will tighten controls around the macOS Full Disk Access setting after finding that some developers grant AI agents broad access to files, mail, messages and browsing history without clear user consent. The change targets agent tools that quietly read everything on a Mac. Apple has not given full technical details or timing.
Sources The Hacker News
US Senate passes bipartisan healthcare cybersecurity bill Confirmed
The US Senate passed a bipartisan bill aimed at strengthening healthcare cybersecurity, set against more than 730 breaches that affected over 270 million Americans last year. The House still has to pass the bill and the President must sign it. The vote follows repeated warnings about weak sector controls and high breach costs.
Sources SecurityWeek
Italy's privacy watchdog fines IQVIA 7 million euros over health data handling Confirmed
Italy’s data protection authority fined IQVIA 7 million euros, about 7.8 million dollars, over data-processing practices it said could have exposed or re-identified roughly one million patients. The decision is a reminder that de-identification claims need technical backing and contractual controls. IQVIA can appeal the fine.
Sources BleepingComputer
ZachXBT says he posed as a client of Lazarus-linked crypto launderers Confirmed
On-chain investigator ZachXBT said he fronted about $349,700 and paid a 5 percent fee to pose as a customer of a Chinese laundering syndicate, allowing him to follow proceeds of the Bybit hack in real time. The operation shows how criminal cash-out networks are being mapped from the inside. It is investigative activity, not an attack on end users.
Sources Decrypt
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.