NetScaler KEV Alert, Denmark Breach, and New CISOs Top This Week's Security News

On 2026-10-06, CISOs need to prioritize the actively exploited Citrix NetScaler flaw CISA added to its KEV catalog and the newly disclosed breach of Denmark's Central Population Register affecting 8.8 million people. Additional patches for Atlassian Data Center products, Microsoft Exchange Server, and Dell System Update demand attention, while Marriott International names a new Global CISO and a detained ShinyHunters suspect reportedly aids the FBI's investigation.

CISA Adds Actively Exploited Citrix NetScaler Flaw to KEV Catalog

CISA added CVE-2026-88779, a Citrix NetScaler memory-buffer vulnerability, to its Known Exploited Vulnerabilities catalog on October 4 after confirming active exploitation. The flaw affects NetScaler ADC and Gateway deployments and can lead to denial of service if triggered repeatedly. Binding Operational Directive 26-04 requires federal civilian agencies to remediate KEV-listed flaws on high-risk, internet-exposed assets and check for prior compromise. CISA urges all organizations, not just federal agencies, to apply the same risk-based remediation priority to this vulnerability given its history as a frequent attack vector. (CISA)

Denmark's Population Register Breach Exposes 8.8 Million People

Denmark's Ministry of Research, Education and Digitalisation disclosed that the Central Population Register (CPR) suffered unauthorized access during September, exposing names, addresses and CPR numbers for 8.8 million residents, deceased people and citizens abroad. The CPR administration learned of irregular activity on October 2 and notified the Danish Data Protection Agency on October 4. Attackers misused a private company's legitimate CPR search access; the company's access has since been cut off. Danish authorities are investigating, and the ministry is warning citizens that the stolen information could be used in fraud attempts. (Help Net Security)

Atlassian Urges Immediate Patching of Critical Data Center File-Access Flaw

Atlassian published an advisory on October 5 for CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability with a 9.3 CVSS score affecting all Data Center versions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. Attackers who know a target file's exact name and path can read it without logging in, though they cannot list directory contents. Atlassian says its cloud products are already patched and found no evidence of exploitation, but it urges administrators to upgrade affected on-prem installations immediately or restrict public internet access until patched. (Help Net Security)

Microsoft Ships Out-of-Band Patch for High-Severity Exchange Server Bug

Microsoft issued an out-of-band security update for Exchange Server fixing CVE-2026-96940, a high-severity vulnerability that could let authenticated attackers read other users' emails and attachments within the same organization, though not across tenant boundaries. Discovered internally, the flaw is not known to have been exploited, but Microsoft considers it consistently exploitable and recommends prompt patching. The update covers Exchange Server Subscription RTM, Exchange Server 2019 cumulative updates 14 and 15, and Exchange Server 2016 cumulative update 23; admins should also update management tools for compatibility. (Help Net Security)

Marriott International Names Daniel Dubowski Global CISO

Marriott International has appointed Daniel Dubowski as Global Chief Information Security Officer, succeeding Arno Van Der Walt and reporting to CIO Naveen Manga. Dubowski joins from Hertz, where he served as SVP and CISO, and previously held security leadership roles at Equifax and InterContinental Hotels Group. His mandate centers on embedding security and trust by design across Marriott's global hospitality technology environment as the company expands its reliance on digital systems for guest experience and operations. (Cyber Magazine)

Detained ShinyHunters Suspect Reportedly Aiding FBI Investigation

A suspected ShinyHunters member known as Rey, identified as Saif al-Din Khader, was detained in Jordan last week and is reportedly assisting the FBI by reviewing his devices and digital correspondence as investigators pursue other members of the group. The detention follows ShinyHunters' claimed breach of FBI job-applicant portals via an Oracle PeopleSoft zero-day, which took the sites offline. The FBI said it continues to investigate the incident and has already worked with international partners to arrest multiple individuals connected to the group. (Help Net Security)

Dell Patches Critical Root-Privilege Flaw in System Update Tool

Dell is advising customers to patch CVE-2026-86360, a path traversal vulnerability in Dell System Update (DSU) with a 9.6 CVSS score that could let an unauthenticated remote attacker execute arbitrary code with root privileges on PowerEdge servers. Successful exploitation could fully compromise both the application and the underlying operating system. Dell also fixed four other high-severity DSU flaws, two allowing remote code execution and two enabling privilege escalation, and recommends upgrading to DSU 2.3.0.0 or later at the earliest opportunity. (Help Net Security)