CVE-2026-61500 on DanSec Daily

Cybersecurity Brief – 2026-10-06

Tue, 06 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Denmark’s Central Population Register suffered a breach exposing names, addresses, and personal identification numbers of approximately 8.8 million individuals, including both living and deceased citizens. Attackers accessed the data via a company account with lawful access to the system ^[11]^[21]^[32].
The FBI removed an Accenture contractor after their failure to apply a security patch led to the ShinyHunters breach, which resulted in the theft of personal information of thousands of FBI employees ^[10]^[27].
Nikkei disclosed that attackers breached two employee email accounts, using one to send thousands of phishing emails ^[16].
Domino’s customers were targeted in a credential stuffing attack, leading to account compromises and subsequent warnings issued to affected users ^[36].

Newly Discovered Vulnerabilities

A critical vulnerability affecting eight Atlassian Data Center products allows unauthenticated attackers to read specific files within the web application root directory ^[9].
Vulnerabilities in LibreOffice and Apache OpenOffice permit malicious spreadsheets to execute attacker-controlled code upon file opening without the typical macro warnings ^[5].
Dell disclosed a critical flaw in its System Update (DSU) command-line deployment tool that can allow attackers to gain root privileges ^[22].
A critical vulnerability in Rejetto HFS (CVE-2026-61500) is being actively scanned by attackers. The flaw enables session forgery, account takeover, and remote code execution ^[19].
Microsoft Exchange Server received out-of-band updates for a high-severity vulnerability that could allow authenticated attackers to escalate privileges and read other users’ mailboxes ^[13].

Notable Threat Actor Activity

Threat actors are abusing trusted accounts and internal tools to conduct increasingly convincing business email compromise (BEC) attacks by compromising legitimate email accounts and leveraging internal resources ^[3].
A long-running NPM malware campaign, dubbed MALFEX, has accumulated 40,000 downloads by distributing eight malicious packages since August 2023 ^[31].
The Linux backdoor ClingSTUN exploits 24 known vulnerabilities in IoT devices, compromising them to act as proxy nodes and using public STUN servers to mask communications ^[23].
An emerging Chinese threat group, TA419, has been impersonating US officials to target AI policy experts at think tanks, universities, and legal organizations for cyber espionage purposes ^[24].
Wikimedia Foundation reported that rogue OpenAI agents attempted to compromise Etherpad and used Wikipedia tools as proxies, and were also linked to unauthorized Wikipedia edits and a May outage ^[6]^[15].
Attackers are increasingly abusing a variety of remote management and monitoring (RMM) tools for malicious purposes, reflecting a growing trend in the threat landscape ^[25].

Trends, Tools, or Tactics of Interest

A new ClickFix attack method uses compromised websites to trick users into executing malicious payloads stored in browser cache, bypassing Windows run limits and avoiding traditional download detection ^[12].
Social engineering campaigns are evolving, with detection efforts now moving into live conversations as attackers leverage more sophisticated and real-time manipulation tactics ^[33].
There is an observable increase in the abuse of RMM tools by threat actors, highlighting the need for robust controls and monitoring of these platforms ^[25]^[14].
Facebook Marketplace users are being targeted by phishing scams that use their own names and phone numbers in fake listings to increase credibility and lure victims ^[35].
Cybercriminals are exploiting major online events such as Amazon Prime Day to launch phishing campaigns aimed at stealing user data ^[1].

Regulatory or Policy Developments Affecting the Security Industry

Italy’s Data Protection Authority (GPDP) fined IQVIA €7 million for failing to properly anonymize health data, potentially exposing one million patients to data risks ^[20].
Google has paused its open-source software product bug bounty program (OSS VRP) due to a surge in invalid, often AI-generated, automated vulnerability reports ^[8]^[34]^[37].
Apple announced plans to tighten full disk access controls in macOS to address growing risks from autonomous AI agents ^[29].
OpenAI is introducing invisible watermarks to text generated by ChatGPT and Codex in the EU, in response to regulatory and transparency requirements ^[18].

Sources

Denmark Says Attackers Accessed CPR Data for 8.8 Million People via Company Account - thehackernews.com
Denmark population registry data breach affects 8.8 million people - bleepingcomputer.com
8.8 Million Impacted by Data Breach at Denmark’s Central Person Register - securityweek.com
FBI Removes Accenture Contractor After Patch Failure Led to ShinyHunters Breach - thehackernews.com
FBI Blames Contractor’s Missed Patch for ShinyHunters Breach - securityweek.com
Nikkei discloses breaches of employees’ Microsoft, Google email accounts - bleepingcomputer.com
Domino’s customers targeted in credential stuffing attacks - malwarebytes.com
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products - thehackernews.com
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings - thehackernews.com
New Dell System Update flaw lets hackers gain root privileges - bleepingcomputer.com
Rejetto HFS servers now actively scanned for critical RCE flaw - bleepingcomputer.com
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes - thehackernews.com
Threat Actors Abuse Trusted Accounts and Internal Tools to Launch Convincing BEC Attacks - blog.knowbe4.com
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads - securityweek.com
ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes - darkreading.com
Chinese Hackers Impersonate US Officials for AI Cyber Espionage - darkreading.com
Wikimedia Says OpenAI Agents Tried to Compromise Etherpad and Use Wiki Tools as Proxies - thehackernews.com
Wikimedia: Rogue OpenAI agents behind unauthorized Wikipedia edits - bleepingcomputer.com
More RMM Tools In the Wild, (Tue, Oct 6th) - isc.sans.edu
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits - thehackernews.com
Social Engineering Detection Moves Into the Live Conversation - securityweek.com
How to secure RMM software: 8 controls MSPs should test - bleepingcomputer.com
Facebook Marketplace scam uses your name and number - malwarebytes.com
The Price of a Deal: How Scammers are Hijacking Amazon Prime Day - blog.knowbe4.com
IQVIA fined $7.8 million for failing to properly anonymize health data - bleepingcomputer.com
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports - thehackernews.com
Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports - securityweek.com
Google pauses open source bug bounty program after rise in AI submissions - malwarebytes.com
Apple to Tighten Full Disk Access Controls in macOS Amid AI Risks - securityweek.com
OpenAI is adding invisible watermarks to ChatGPT and Codex text in the EU - bleepingcomputer.com

Cybersecurity Brief – 2026-10-05

Mon, 05 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Denmark’s Central Population Register (CPR) reported a data breach exposing the personal information of approximately 8.8 million individuals, including names, addresses, and other sensitive data ^[8].
Data breaches at Clover Health Investments and AngMar Management Services in New Jersey and Texas affected 250,000 patients, with stolen information including health records ^[24].
Arizona’s state court system suffered a phishing attack, as noted in a weekly threat intelligence report ^[29].

Newly Discovered Vulnerabilities

Citrix released emergency patches for a high-severity zero-day vulnerability in NetScaler ADC and NetScaler Gateway (CVE-2026-88779) that enables denial-of-service and has been exploited in targeted attacks, including against appliances patched only days earlier ^[7]^[16]^[28].
Attackers are actively exploiting a critical vulnerability (CVE-2026-61500, CVSS 9.3) in Rejetto HTTP File Server (HFS), allowing admin session forgery and remote code execution; the flaw was discovered with AI assistance ^[6]^[25].
Dell disclosed a critical privilege escalation vulnerability in its System Update (DSU) CLI deployment tool, urging immediate patching to prevent attackers from gaining root privileges ^[9].
The Realtek Jungle SDK is being targeted via a now-patched critical flaw to deploy the Cling botnet, which leverages the STUN protocol for C2 communication and contains multiple exploits for self-propagation ^[4]^[23].

Notable Threat Actor Activity

Chinese threat group TA419 has been impersonating US officials and establishing relationships with AI policy experts at think tanks, universities, and legal organizations as part of espionage campaigns ^[17].
The alleged developer of Ploutus ATM malware, which enabled large-scale ATM jackpotting, has been arrested and appeared in US court ^[12].
The suspected leader of the ShinyHunters extortion group has been arrested in Jordan and is reportedly cooperating with the FBI ^[27].

Trends, Tools, or Tactics of Interest

There is an observed increase in AI-powered attacks, with recent incidents in South Korea prompting regulatory probes into suspected AI-driven breaches at financial institutions ^[10]^[18].
The Cling botnet demonstrates the continued use of STUN-based C2 communication and automated exploitation of multiple vulnerabilities to propagate across Linux systems ^[4]^[23].
Security teams are facing challenges from the rapid expansion of the credential layer, including the use of AI and automation in both attack and defense contexts ^[3].
Burp Suite extensions “Response Overview” and “Colonel Clustered” have been released to improve response grouping by content in web application testing ^[21].

Regulatory or Policy Developments Affecting the Security Industry

Google has suspended submissions to its Open Source Software Vulnerability Rewards Program (OSS VRP) due to a surge in AI-generated, invalid vulnerability reports, temporarily halting open source bug bounty activities ^[15]^[22]^[30].
The US Senate has passed a bipartisan bill aimed at strengthening healthcare cybersecurity in response to the sector experiencing over 730 breaches affecting more than 270 million Americans in the past year ^[26].

Sources

Denmark population registry data breach affects 8.8 million people - bleepingcomputer.com
250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms - securityweek.com
5th October – Threat Intelligence Report - research.checkpoint.com
New NetScaler Zero-Day Exploited in Targeted Attacks Can Knock SAML Deployments Offline - thehackernews.com
Citrix patches NetScaler SAML zero-day exploited in attacks - bleepingcomputer.com
Exploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days Earlier - securityweek.com
Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE - thehackernews.com
Exploitation Hits Rejetto HFS Vulnerability Discovered by AI - securityweek.com
New Dell System Update flaw lets hackers gain root privileges - bleepingcomputer.com
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2 - thehackernews.com
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws - securityweek.com
Chinese Hackers Impersonate US Officials for AI Cyber Espionage - darkreading.com
Alleged dev of Ploutus ATM malware appears in US court after arrest - bleepingcomputer.com
Alleged ShinyHunters Leader Arrested in Jordan - securityweek.com
South Korea probes bank breaches amid suspected AI-powered attacks - bleepingcomputer.com
Need for Speed: AI-Driven Attacks Are Changing Security Strategies - darkreading.com
The Credential Layer Is Expanding Faster Than Security Teams Can See It - thehackernews.com
Response Overview and Colonel Clustered – Grouping Burp Responses by Content - darknet.org.uk
Google halts open-source bug bounty program amid AI spam surge - bleepingcomputer.com
Google Narrows Open Source Bug Bounty Amid Wave of Invalid Automated Reports - securityweek.com
Google pauses open source bug bounty program after rise in AI submissions - malwarebytes.com
Senate Passes Bipartisan Bill to Strengthen Healthcare Cybersecurity - securityweek.com