Cyber SOTU: The Week Trust Stopped Working (Oct 4–11, 2026)

Welcome back to the Cyber SOTU — the State of Cyber, delivered every Sunday. Six stories from the week that mattered, translated into plain English: what happened, why you should care, and what to do about it.

🇩🇰 Denmark's entire population registry got breached — 8.8 million people

What happened: Attackers pulled names, addresses, and national ID numbers for roughly 8.8 million people out of Denmark's Central Person Register (CPR) — by misusing a private Danish company's legitimate search access and brute-forcing CPR numbers to enumerate entries. The number exceeds Denmark's ~6 million population because the register holds the deceased and the emigrated (~11 million records total). Irregular activity was detected October 2; the scale became clear over the weekend of Oct 3–4. The company's access was revoked, police are investigating, and minister Christina Egelund ordered a security review while warning of fraud.

Why it matters: This is the crown-jewels scenario: a national ID registry, the thing you can't rotate, enumerated like a public API. And note the method — no zero-day, no malware. Just a trusted partner's legitimate access abused at scale. The biggest breaches this year keep coming through the front door, not the window.

What to do: If you're one of the 8.8 million (or know someone who is): watch for fraud and identity-theft attempts using your real details. Everyone else: this is the week to ask your vendors how their partners' search access to your data is rate-limited and monitored. Source: BleepingComputer →

🛡️ CISA gave federal agencies 3 days to patch five bugs — all exploited by Chinese actors

What happened: On October 8, CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog with a federal due date of October 11 — a three-day window that's exceptionally short. The five: CVE-2015-3306 (ProFTPD, CVSS 10.0), CVE-2021-3199 (ONLYOFFICE Docs, CVSS 9.8), CVE-2023-22894 (Strapi, CVSS 7.2), CVE-2016-3081 (Apache Struts, CVSS 8.1), and CVE-2015-5477 (ISC BIND, CVSS 7.5). The exploitation is attributed to Chinese state-linked actors associated with Integrity Technology Group, and a seven-nation joint advisory (US, UK, Canada, Australia, Japan, New Zealand, Spain) went out with it.

Why it matters: Four of these five CVEs are years old — 2015 to 2021 — with patches available for ages. A nation-state doesn't need zero-days when the world is still running unpatched 2015 software. When CISA hands federal agencies a 3-day deadline on decade-old bugs, the message is: the threat actor is in the building, not at the gate.

What to do: If you run ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, or ISC BIND anywhere: patch now and hunt for compromise indicators from the joint advisory. This one is forensic triage, not just patching. Source: DeafNews →

🔒 FortiBleed is still raging — 86,000+ stolen credentials and rogue admins

What happened: The FBI and U.S. Secret Service jointly warned this week that FortiBleed attacks remain active. Threat actors are using more than 86,000 compromised credentials to seize Fortinet devices, establish rogue administrator accounts, lock IT teams out of their own devices, and create footholds usable for ransomware operations.

Why it matters: The attacker playbook here is brutal and effective: steal creds, make yourself admin, lock out the real admins. Recovery from that isn't a patch — it's a rebuild. When the FBI and Secret Service co-sign a warning, the campaign is widespread and the remediation is painful.

What to do: If you run Fortinet gear: patch immediately, audit every admin account for rogue additions, rotate all credentials, and verify you can actually still log in to your own devices. Assume anything pre-patch is suspect. Source: TechRepublic →

🗾 Japan declared a "state of emergency in cyber space"

What happened: On October 9, Japan's National Cybersecurity Strategy Headquarters convened an emergency meeting. Its head, Masaaki Taira, said the country faces "a state of emergency in cyberspace." More than 20 major companies disclosed attacks in recent weeks, with tens of millions of customer records potentially exposed. Examples: JR East lost 1.67 million customer email addresses in a ransomware attack on SoftBank subsidiary IDC Frontier; car-rental operator Times Car leaked photos of ~1.6 million people's driver's licenses; skyticket flagged up to 14.6 million customer records; Yakiniku King lost data on 10.8 million members. The Financial Services Agency responded by telling lenders to stop treating ID photos as proof of identity and read the chip in the ID card instead.

Why it matters: A G7 government used the word "emergency" for a cybercrime wave. Analysts point to AI lowering the barrier: generative models now let foreign actors produce flawless Japanese-language phishing and scan for vulnerabilities at scale. And the FSA's ID-photo ruling is a watershed — one leak just killed an entire identity-verification method for a whole country's banking sector.

What to do: If you verify identity via uploaded ID photos: Japan's regulator just ruled that method dead. Move to chip reads, in-person checks, or stronger alternatives. Everyone else: watch how fast AI-assisted phishing is scaling — your awareness training is fighting a machine now. Source: PYMNTS →

🔏 Attackers forged real TLS certificates for Google — by hijacking country domains

What happened: Google disclosed on October 6 that attackers hijacked the registries of three country-code top-level domains — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) — altered authoritative DNS records, and used that control to pass certificate authorities' domain-validation checks. The result: real, browser-trusted TLS certificates for Google domains and other major brands, issued to people who had no business holding them. Let's Encrypt issued 11 of the 12 certificates The Hacker News found; Google blocked the fakes in Chrome via CRLSets and worked with CAs on revocation.

Why it matters: This is an attack on the trust model of the entire web. The attackers never touched Google's systems or tricked a CA employee — they operated one layer higher, at the registry. The padlock in your browser bar was green and it was a lie. Google is blunt about the limits of its cleanup: it cannot guarantee it found every unauthorized certificate, and Chrome's blocking doesn't reliably protect non-Chrome users.

What to do: Chrome users need do nothing — the blocks shipped automatically. If you run a domain: monitor Certificate Transparency logs and publish restrictive CAA records. If you manage DNS for anything important: this is your week to review who controls your registrar accounts. Source: SC Media →

🌐 A fresh NetScaler zero-day is under active attack (CVE-2026-88779)

What happened: A new Citrix NetScaler zero-day, CVE-2026-88779, is being actively exploited: the flaw can crash customer-managed NetScaler ADC and Gateway appliances configured for SAML into denial-of-service. CISA added it to the KEV catalog with a federal mitigation deadline of October 7 — which has already passed. Citrix has released fixed builds.

Why it matters: This is the network edge again — the same appliance family that dominated last month's SOTU with webshells everywhere. Attackers keep hammering NetScaler because it's the front door: VPN, remote access, auth. The SAML angle is the spicy part — it's the single-sign-on path, so DoS here doesn't just break a box, it breaks the login flow.

What to do: Install Citrix's fixed builds and investigate any unexplained appliance crashes in the last few weeks. If your federal deadline was October 7, "already patched" is the only acceptable answer. Source: TechRepublic →

That's the state of cyber for the week of October 4–11. Trust, but verify — and this week, mostly verify. I'll see you next Sunday. 🐱