Security Roundup: Citrix NetScaler SAML Zero-Day, Denmark 8.8M Registry Breach, Rejetto AI RCE, Asian Financial Infiltrations (Weekend of October 5, 2026)

Executive Summary: The weekend of October 3–5, 2026, delivered an unprecedented surge of critical perimeter exploits, monumental government and enterprise data leaks, and AI-driven intrusion vectors. Headlining the emergency alerts, Citrix confirmed active targeted exploitation of CVE-2026-88779—a high-severity memory overflow zero-day in NetScaler ADC and Gateway configured as SAML SP or IdP—prompting CISA to mandate emergency remediation under BOD 26-04 by October 7. In Europe, Denmark disclosed that unauthorized actors weaponized legitimate partner access to scrape 8.8 million citizen records from the Central Person Register (CPR), while DTU suffered an identity system breach exposing 200,000 users. In Asia, 10.79 million member records were leaked from Japanese restaurant conglomerate Monogatari Corporation, Daiwa Securities suffered a 110,000-account supply chain breach via vendor Scala Communications, and South Korea’s top four banks faced AI-orchestrated credential stuffing waves. Furthermore, an AI model discovered a critical CVSS 9.8 RCE in Rejetto HTTP File Server (CVE-2026-61500) that is now under active wild exploitation, and a key ShinyHunters operator was detained in Jordan cooperating with the FBI. Here is your comprehensive strategic briefing and engineering breakdown.

Key Threat Disclosures at a Glance

1. Citrix NetScaler SAML Memory Overflow Zero-Day (CVE-2026-88779)

Just days after the critical patch cycle for late-September's dual zero-days (CVE-2026-88771/72), Citrix issued security bulletin CTX697174 and CISA immediately added CVE-2026-88779 to the KEV catalog on October 4, 2026. The vulnerability is a memory buffer overflow (CWE-119) within the NetScaler packet engine triggered when processing malformed SAML authentication payloads. Appliances configured as either a SAML Service Provider (samlAction) or SAML Identity Provider (samlIdPProfile) are vulnerable to remote denial of service and memory corruption. CISA has mandated emergency patching across all federal civilian agencies by October 7, 2026.

2. Denmark Central Person Register (CPR) 8.8 Million Citizen Leak

On Monday morning, October 5, 2026, the Danish Ministry of Higher Education, Research, and Digitalisation confirmed a massive security catastrophe: personal information belonging to approximately 8.8 million people—encompassing current residents, expatriates, and deceased citizens—was scraped from the national Det Centrale Personregister (CPR). The threat actors did not breach the core database directly; rather, they hijacked the legitimate API query pipeline of an authorized private Danish firm throughout September 2026, systematically extracting names, addresses, and 10-digit CPR civil registration numbers.

3. Rejetto HFS AI-Discovered RCE Under Active Exploitation (CVE-2026-61500)

In a historic development at the intersection of AI research and threat actor weaponization, CVE-2026-61500 (CVSS 9.8) was identified in Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. Discovered by researchers using Anthropic’s "Mythos" AI model, the flaw stems from the use of Math.random() for session-cookie signing key derivation combined with the disclosure of PRNG states in unauthenticated login handshakes. Over the weekend, threat telemetry confirmed active wild exploitation targeting exposed servers across the United States and Japan, prompting an urgent upgrade advisory to version 3.2.1.

4. Monogatari Corporation (Yakiniku King) 10.79M Record Breach

Confirmed on October 3, 2026, Japanese restaurant and hospitality titan Monogatari Corporation (operator of the popular Yakiniku King and Marugen Ramen chains) disclosed an extensive database leak. An unauthenticated external entity gained unauthorized access to customer loyalty database clusters, exfiltrating 10,790,000 member records including full customer names, telephone numbers, and email addresses. Forensic response teams have isolated the compromised cloud storage nodes.

5. Daiwa Securities & Scala Communications Third-Party Breach

On October 4, 2026, Japan’s second-largest brokerage, Daiwa Securities Group, disclosed that an external IT vendor, Scala Communications Inc., suffered a server compromise. Threat actors accessed staging and communications servers holding data on approximately 110,000 brokerage clients, exposing account numbers, names, and registered email addresses. This incident highlights the acute risk of fourth-party software dependencies in wealth management.

6. South Korean Mega-Banks Hit by Coordinated AI Credential Stuffing

Financial authorities in South Korea confirmed that four leading commercial banks—Shinhan Bank, KB Kookmin Bank, Hana Bank, and Woori Bank—experienced synchronized account takeover attacks over the weekend. Threat actors deployed automated AI agents to steer distributed residential proxy networks, dynamically varying request timing to bypass web application firewall (WAF) rate limits and successfully compromising approximately 70,000 account holders' financial profiles.

7. ShinyHunters Leadership Fractured: Key Operative Detained in Jordan

International law enforcement confirmed on October 3–5, 2026, that a primary figure in the notorious ShinyHunters cyber extortion syndicate has been taken into custody in Amman, Jordan. The operative is currently cooperating with the Federal Bureau of Investigation (FBI), handing over server keys and decryption tools following weeks of retaliatory leak threats against federal agencies and commercial cloud providers.

8. Technical University of Denmark (DTU) DTUBasen IAM Compromise

In a synchronized Danish identity crisis, the Technical University of Denmark (DTU) disclosed that its core identity management portal, DTUBasen, was breached via compromised administrative credentials. The attackers exfiltrated records spanning from 2003 to 2026, potentially affecting 200,000 active and former students and faculty, exposing CPR numbers, home addresses, and emergency next-of-kin contacts.

Dedicated Technical Deep Dives in This Series

• CVE-2026-88779: Citrix NetScaler SAML Memory Overflow Zero-Day Added to CISA KEV: Deep protocol analysis of NetScaler SAML buffer overflow, memory crash mechanics, and emergency deny list filters.
• Denmark Central Person Register Breach: 8.8 Million Citizen Records Exposed via Authorized Partner Misuse: Architectural post-mortem of Denmark's 8.8M CPR register exfiltration via abused B2B API authorization pipes.
• CVE-2026-61500: Rejetto HFS Critical RCE Discovered by AI Model Under Active Exploitation: Cryptanalytic teardown of CVE-2026-61500: how Mythos AI uncovered non-cryptographic PRNG cookie forgery in Rejetto HFS.
• Monogatari Corporation Breach: 10.79 Million Customer Records Leaked in Japanese Hospitality Incident: Forensic breakdown of Monogatari Corporation’s 10.79M customer loyalty database exposure in Tokyo.
• Daiwa Securities Supply Chain Breach: Vendor Server Compromise Exposes 110,000 Client Accounts: Supply chain blast radius: analyzing the Scala Communications breach and Daiwa Securities brokerage exposure.
• South Korean Banking Wave: Shinhan, KB Kookmin, Hana & Woori Hit in AI-Assisted Breach: Reverse-engineering the AI-guided residential proxy swarm targeting South Korea’s top financial institutions.
• ShinyHunters Syndicate Operator Detained in Jordan: FBI Cooperation and Extortion Fallout: The capture of ShinyHunters in Amman: geopolitical law enforcement operations and dark web extortion fallout.
• Technical University of Denmark (DTU) Breach: 200,000 Identities Exposed via DTUBasen IAM: Technical University of Denmark IAM autopsy: identity lifecycle hygiene and legacy database exposure.
• Enterprise Hardening Blueprint: Securing SAML Gateways, Partner API Pipelines & Supply Chain Enclaves: The Enterprise Hardening Blueprint: actionable configurations for SAML gateway isolation, partner API quotas, and zero-trust perimeter resilience.

Weekend Action Checklist for CISOs & SecOps

1. Patch Citrix NetScaler SAML Instances by Oct 7: Audit NetScaler configurations with grep -E 'samlAction|samlIdPProfile' /nsconfig/ns.conf. Upgrade vulnerable builds immediately to 14.1-73.41 or 13.1-64.28, or deploy Citrix Global Deny List signatures.
2. Audit B2B & Third-Party API Query Quotas: Review all external API integrations that have access to sensitive PII or core databases. Implement strict anomaly thresholds and velocity caps on partner API keys to prevent automated CPR-style scraping.
3. Remediate Rejetto HFS Instances: Scan internet-facing infrastructure for exposed Rejetto HTTP File Server nodes and immediately upgrade to 3.2.1+ to prevent AI-discovered PRNG session hijacking.
4. Deploy Behavioral Botnet Defense on Login Portals: Financial institutions and SaaS platforms must implement biometric entropy and residential proxy reputation scoring to thwart AI-orchestrated credential stuffing waves.
5. Review Legacy IAM Data Retention: Purge historical alumni and former employee records from active directory schemas. Sensitive national identifiers (SSNs, CPR numbers, PESEL) must never reside in unsegmented legacy web databases.