💥 BREACHES & INCIDENTS
- Denmark CPR breach exposes names, addresses and CPR numbers of 8.8 million people
Denmark confirmed unauthorized actors accessed personal records of about 8.8 million people in its Central Person Register.- Affects people registered in Denmark's Central Person Register (CPR), including living residents, emigrants and deceased individuals; the register holds about 11 million records.
- Exposed data includes names, addresses and CPR numbers; people with name and address protection were not among those whose names and addresses were accessed.
- Attackers misused a private Danish company's lawful search access under Section 38 of the Civil Registration Act during September 2025; no software flaw in the register has been confirmed.
- The CPR administration detected unusual activity on October 2, 2026, blocked the company's access, reported the breach to the Data Protection Authority, and police are investigating; the company and attackers have not been named.
- Minister Christina Egelund called the incident deeply serious, informed Parliament's Business and Digitalization Committee, and ordered a thorough security review of the CPR system.
Sources 📄 Source: ufm.dk · 📎 Coverage: securityonline.info · 👁 via Cyber Security News, cryptika.com (discovered)
📋 ADVISORIES
Apple to tighten macOS Full Disk Access controls over AI agent privacy risks
Apple announced it will add stricter controls to macOS Full Disk Access because AI agents make broad disk access riskier.- Applies to macOS apps granted Full Disk Access, a permission introduced in macOS Mojave (10.14) and managed via Privacy & Security settings
- Full Disk Access lets apps bypass normal privacy controls and read files, Mail, Messages, Safari data, and Time Machine backups
- Apple says some developers use the permission in ways that expose users' data without full understanding, and communication apps can also expose contacts' privacy
- New controls will require very explicit user action before granting this level of access; no release date announced
- The move follows reports of Meta's Muse agent reading private iMessages and Patrick Wardle's 'not-a-mused' zero-day PoC against the Muse Mac app
Sources 📄 Source: developer.apple.com · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, Cyber Security News (+1)📄 Source for Google pauses OSS VRP product vulnerability submissions over flood of invalid AI-generated reports — x.com
📄 Source for Phishing Emails Deliver Legit, Signed ScreenConnect Client Preconfigured for Attacker Remote Access — isc.sans.edu
📄 Source for CVE-2026-105285: Critical pre-auth stack buffer overflow in Totolink A3002MU QoS handler — vuldb.com
📄 Source for Joomla 5.4.9 and 6.1.4 let extension developers flag updates as security releases — joomla.org
🔓 CVEs & KEV
CVE-2026-63277 — The Document Foundation LibreOffice — CVSS 8.5 — RCE via calcext:data-mappings, sql provider and jdbc connectorLibreOffice Cal...
CVE-2026-59786 — Zabbix — CVSS 6.9 — Active agent heartbeat missing TLS checkZabbix Server and Proxy accept the ac...
CVE-2026-59782 — Zabbix — CVSS 6.9 — JavaScript preprocessing memory disclosureThe JavaScript preprocessing (Dukta...
CVE-2026-63266 — The Document Foundation LibreOffice — CVSS 6.8 — Arbitrary file write via calcext:data-mappings, sql provider and Firebird bac...
CVE-2026-63270 — The Document Foundation LibreOffice — CVSS 6.7 — Environment/ini-file leaksURLs could be constructed which expanded environmen...
CVE-2026-63269 — The Document Foundation LibreOffice — CVSS 6.7 — LFI and GET SSRF via GStreamer and HLS playlistsLibreOffice can link to audio...
CVE-2026-63268 — The Document Foundation LibreOffice — CVSS 6.7 — LFI via calcext:data-mappings, sql provider and sdbc:flat:file:// db hrefLibr...
CVE-2026-63267 — The Document Foundation LibreOffice — CVSS 6.7 — LFI and GET SSRF via calcext:data-mappings and csv providerLibreOffice Calc c...