Third NetScaler Zero-Day in Days, Denmark's National Registry Breached, and Nikkei Mailbox Takeover Fuels Phishing

The weekend brought a third actively exploited Citrix NetScaler vulnerability in little more than a week, forcing teams that patched in late September to upgrade again. Two disclosures, Denmark's national population registry and Japan's Nikkei, show how attackers turn legitimate access into large-scale data theft and convincing phishing. Meanwhile, a reported arrest in Jordan may open a new window into the ShinyHunters extortion crew.

Priority at a glance

Only the NetScaler flaw is a software bug under active exploitation. The other three stories are about access that already looked legitimate — a vendor's registry queries, two valid user sessions and a reported law-enforcement development.

1. Citrix patches a third exploited NetScaler flaw in about a week (CVE-2026-88779)

What happened. Citrix published an emergency bulletin (CTX697174) for CVE-2026-88779, a memory overflow in NetScaler ADC and NetScaler Gateway, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 4. Citrix reports targeted attacks on unmitigated appliances that cause denial of service; repeated triggering can keep the service down. It follows CVE-2026-88771 and CVE-2026-88772, both exploited and added to KEV on September 27, so appliances already updated for those flaws remain exposed to this one.

Who is affected. Customer-managed NetScaler ADC and Gateway appliances configured as a SAML Service Provider (add authentication samlAction) or SAML Identity Provider (add authentication samlIdPProfile). Vulnerable builds are 14.1 before 14.1-73.41, 13.1 before 13.1-64.28, 14.1-FIPS before 14.1-73.41 FIPS, and 13.1-FIPS/NDcPP before 13.1-37.282. Citrix is updating its managed cloud services itself.

Severity. CVSS v4.0 8.7 (High), CWE-119. Citrix classifies the impact as denial of service only. Researchers monitoring honeypots have described follow-on payload downloads, so treat code execution as unconfirmed rather than ruled out. US federal agencies must remediate by October 7.

Analysis. This is the third actively exploited NetScaler flaw in roughly a week, following two additions to KEV on September 27. A platform that produces three exploited flaws in quick succession turns patching into a moving target: appliances already fixed for the first two CVEs are still exposed to this one. Any organization running SAML on NetScaler needs a process for rapid re-patching and compromise checks, not a one-time project.

What to do. — click a step to check it off, click any code snippet to copy it

1. Upgrade any appliance with a SAML SP or IdP configuration to the fixed builds now, even if it was patched last week.
2. If an immediate upgrade is impossible, put SAML-dependent remote access on your incident watch list and plan for an outage window.
3. Review appliance logs and crash records since late September for unexpected reboots, unusual authentication requests and unknown files; investigate any appliance that rebooted unexpectedly.
4. Confirm earlier remediation for CVE-2026-88771/88772 included session termination and compromise checks, not just the upgrade.

2. Denmark's national registry: 8.8 million records accessed through a company's legitimate access

What happened. Denmark's CPR administration and the Ministry of Research, Education and Digitalisation announced on October 5 that unauthorized parties misused a private Danish company's lawful search access to the Central Person Register. Irregular activity took place during September and was detected on the evening of Friday, October 2.

Who is affected. Names, addresses and CPR numbers of about 8.8 million registered people, including living, emigrated and deceased individuals. People with name and address protection were not included. The company's access has been cut off, the Danish Data Protection Agency notified, and police are investigating. The company has not been named.

Why it matters. This is a supply-chain access failure, not a perimeter breach: a trusted integration was used to bulk-query a national dataset. The data is ideal for highly credible phishing, vishing and identity fraud against Danish residents and the organizations that serve them.

What to do. — click a step to check it off

1. Organizations with Danish staff or customers: warn them that callers or emails quoting correct CPR numbers and addresses are not proof of legitimacy.
2. Stop treating national ID numbers as a secret or as an authentication factor in helpdesk, account-recovery and customer-service workflows.
3. Review every third party with query access to your sensitive data: enforce per-client volume limits, alert on bulk or off-pattern lookups, and require strong authentication for API credentials.

3. Hijacked Nikkei mailbox sends 9,000 phishing emails; second account takeover disclosed

What happened. Japan's Nikkei disclosed on October 4 that an attacker logged in to an employee's Microsoft 365 account and, on September 30, sent about 9,000 impersonation emails linking to malicious sites. Recipients included colleagues and journalistic sources who had corresponded with several employees. Nikkei says recipients' names and email addresses, and some email content, were likely exposed.

Second incident. In a separate notice, Nikkei said employee Google Workspace accounts had been accessed from outside since late July, possibly exposing the names and email addresses of 1,646 employees and business partners. Nikkei reset passwords, reported both incidents to Japan's Personal Information Protection Commission and warns that further impersonation emails may follow.

Analysis. One compromised mailbox with a large, trusted contact list turned into 9,000 convincing phishing attempts almost instantly — the multiplier effect that makes journalist and sales mailboxes attractive targets. A second, unrelated-looking compromise sitting undetected since late July also shows how long account-level access can go unnoticed without anomaly-based monitoring.

What to do. — click a step to check it off

1. Enforce phishing-resistant MFA (passkeys or FIDO2) for email and collaboration accounts, prioritizing staff with large external contact lists.
2. Alert on unusual outbound mail volume and new inbox rules, and cap per-user sending rates.
3. Tell partners how to verify unexpected links or requests that appear to come from your staff.

4. ShinyHunters member "Rey" reportedly detained in Jordan

What happened. Reuters reported on October 3, citing people familiar with the matter, that Saif al-Din Khader, known as "Rey," was detained in Jordan and is helping the FBI identify other members of the ShinyHunters extortion group. Neither the FBI nor Jordanian authorities have publicly confirmed the detention. Dutch police arrested a 24-year-old Amsterdam man in the same investigation in September.

Context. The group recently claimed a breach of the FBI's recruitment portal, allegedly through an Oracle PeopleSoft zero-day. Rey has been linked to the Scattered LAPSUS$ Hunters collective and to earlier data-theft cases, including Telefónica in 2025.

What to do. Arrests rarely stop a loosely organized extortion crew immediately; affiliates often accelerate or rebrand. Keep defenses aimed at social engineering of help desks, abuse of SaaS integrations and data theft, and keep extortion response plans current.

Touchpoint's Take

Today's stories share a theme: attackers succeed by using access that already looks legitimate. In Denmark it was a company's authorized registry queries; at Nikkei and DTU, valid user sessions; at the network edge, the very appliances that broker authentication. Controls that ask only whether a credential is valid miss all of these. The more useful question is whether the activity is normal for that identity, integration or device: volume, timing, destination and sequence.

The NetScaler sequence also argues for treating edge appliances as a continuously managed risk, not a quarterly patch item. When a platform produces three exploited flaws in about a week, "patched" describes a moment rather than a state. Teams should plan for rapid re-patching, keep compromise checks in the runbook, and know which services depend on those appliances.

What we would change in a security program:

1. Audit third-party query access to sensitive data. Enforce per-client volume limits and alert on bulk or off-pattern lookups — the Denmark breach went undetected for weeks because the access itself was legitimate.
2. Treat national ID numbers and similar "secrets" as public. Remove them as an authentication factor anywhere they're currently used that way.
3. Plan for rapid re-patching on edge appliances. A fixed build today doesn't mean fixed tomorrow — know what depends on each appliance before the next flaw lands.
4. Monitor for anomalous identity and mailbox behavior, not just failed logins. Volume, timing and destination catch what valid credentials hide.

If you would like help assessing your exposure to any of these issues, the Touchpoint Security team is available to talk.

Sources

• Citrix Security Bulletin CTX697174 for CVE-2026-88779
• CISA Known Exploited Vulnerabilities catalog (official data feed)
• BleepingComputer: Citrix patches NetScaler SAML zero-day exploited in attacks
• SecurityWeek: Exploitation of Citrix NetScaler zero-day hits appliances patched days earlier
• The Hacker News: New NetScaler zero-day exploited in targeted attacks
• CPR: Omfattende uautoriseret adgang til borgeres CPR-oplysninger
• Ministry of Research, Education and Digitalisation press release
• Nikkei: Information leak and suspicious emails from cyberattack (Microsoft 365)
• Nikkei: Google Workspace unauthorized access notice
• BleepingComputer: ShinyHunters hacker reportedly detained in Jordan, aiding FBI
• SecurityWeek: Alleged ShinyHunters leader arrested in Jordan
• The Hacker News: ShinyHunters suspect Rey reportedly detained in Jordan
• KrebsOnSecurity: Dutch police arrest 'reformed' hacker in ShinyHunters investigation
• DTU: Cyberattack on DTU, notification of a personal data breach
• BleepingComputer: Danish university DTU breach exposes data of up to 200,000 people