Nostr notes by Dark Web Informer :verified_paw:

🚨🇺🇸 Veeam patches critical Backup & Replication ...

2026-10-28T00:14:19Z

🚨🇺🇸 Veeam patches critical Backup & Replication authorization bypass

Veeam has released security updates addressing five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE.
⠀
The most serious, CVE-2026-108142, carries a CVSS score of 9.1 and allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.
⠀
Other patched vulnerabilities include:

• CVE-2026-105477: Local privilege escalation in managed Veeam Agent for Linux installations, CVSS 7.3
• CVE-2026-108140: Arbitrary file writes through path traversal, CVSS 5.9
• CVE-2026-108141: Arbitrary file writes through path traversal, CVSS 5.9
• CVE-2026-107671: Veeam ONE administrator can bypass MFA by disabling it before completing verification, CVSS 8.5
⠀
Backup & Replication versions 13.0 and 13.1 are affected by the authorization and path-traversal flaws.

Older 12.x releases are not affected by those specific issues.
⠀
Administrators should update to:

• Backup & Replication 13.1.2 build 13.1.2.57
• Backup & Replication 13.0.3 build 13.0.3.63
• Veeam Agent for Linux 13.1.2 build 13.1.2.11
• Veeam ONE 13.1 P1 build 13.1.0.7940

Sources: https://www.veeam.com/kb4948, https://www.veeam.com/kb4951

🚨🇨🇭 Nearly 100,000 Swiss medical professional records ...

2026-10-27T23:44:11Z

🚨🇨🇭 Nearly 100,000 Swiss medical professional records advertised in MedReg data leak

A dataset containing 99,201 records linked to MedReg, Switzerland's national register of medical professionals, has been advertised by the actor "92cityuhq".

The 98 MB archive reportedly contains names, birth years, genders, nationalities, professional qualifications, medical specialties, licensing information, and practice authorization details.

Sample records have been published, with the full dataset offered for download. Unknown if the information was obtained through a security breach or collected from publicly accessible registry records.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP ...

2026-10-27T23:34:45Z

🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed

Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".

The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.

According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.

The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.

A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

⚠️ Disclaimer: This video explores disturbing allegations, ...

2026-10-27T23:15:13Z

⚠️ Disclaimer: This video explores disturbing allegations, unsettling online behavior, and sensitive subject matter involving minors.

smartschoolboy9: An Internet Rabbit Hole

In April 2024, a Reddit user uncovered a disturbing collection of Instagram accounts that appeared to be operated by children. But a closer look at their unsettling content raised serious questions about who was really behind them and what was happening out of sight.

What followed was a descent into one of the internet’s most bizarre and disturbing mysteries: smartschoolboy9, a rabbit hole that continues to raise questions to this day.

Video Credit: youtube.com/@NickCrowley

‼️ New Dark Web Informer Blog Post! Title: Daily Dose of Dark ...

2026-10-27T23:01:48Z

‼️ New Dark Web Informer Blog Post!

Title: Daily Dose of Dark Web Informer - October 27, 2026

Link: https://darkwebinformer.com/daily-dose-of-dark-web-informer-october-27-2026/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨🇺🇸 Hackers target Federal Election Commission, forcing ...

2026-10-27T21:25:40Z

🚨🇺🇸 Hackers target Federal Election Commission, forcing filing system offline

The U.S. Federal Election Commission temporarily shut down its electronic filing system after hacking attempts disrupted the service one week before the November 3 midterm elections.
⠀
The outage prevents political committees and other organizations from submitting mandatory 24-hour and 48-hour spending reports, reducing the amount of current campaign-finance information available to the public.
⠀
The system has reportedly been offline since around 10 p.m. ET on October 26. FEC staff are working to restore the service, while previously filed reports remain searchable on the agency’s website.
⠀
There is currently no confirmation that the attackers gained access, stole data or altered any filings. The identity and motive of those responsible also remain unknown.
⠀
The FEC tracks campaign spending but does not administer elections. The incident should not affect voter registration, ballot systems or the public’s ability to vote.

Source: https://www.reuters.com/technology/hacker-trying-breach-us-federal-election-commission-system-email-shows-2026-10-27/

🚨🇫🇷 ACF Assurances customer data allegedly leaked, ...

2026-10-27T19:55:42Z

🚨🇫🇷 ACF Assurances customer data allegedly leaked, 23,000 records advertised

A French insurance brokerage firm, ACF Assurances, has been named in a data leak by the actor "Alduin", who claims to have obtained policyholder information.

The 6.8 MB dataset reportedly contains customer names, email addresses, mobile numbers, dates of birth, residential addresses, postal codes, and cities.

Sample records have been published, exposing personal and contact information. The source and authenticity of the data have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

"Speedstepper" has been added to the OpSec Failures page. ...

2026-10-27T18:29:18Z

"Speedstepper" has been added to the OpSec Failures page.

Direct file: https://darkwebinformer.com/opsec-failures/#file-speedstepper

🚨🇺🇸 Connecticut man accused of using the dark web to ...

2026-10-27T18:07:33Z

🚨🇺🇸 Connecticut man accused of using the dark web to download and share child sexual abuse material

Jared James, 31, of Hartford, has been arrested after police allegedly found more than 2,000 child sexual abuse images and videos on electronic devices inside his apartment.

Hartford police say investigators determined that James used the dark web to download and share videos depicting child sexual abuse.

Detectives from the department’s Child Exploitation Prevention Unit executed a search warrant at his Capitol Avenue apartment on October 23 and seized several electronic devices.

James was charged with first-degree possession of child sexual abuse material and held on a $500,000 bond.

Source: https://patch.com/connecticut/hartford/hartford-man-accused-having-2-000-images-child-porn-police

🚨🇬🇧 UK lawmaker Jess Asato takes xAI to court over ...

2026-10-27T17:54:32Z

🚨🇬🇧 UK lawmaker Jess Asato takes xAI to court over sexualized Grok deepfakes

Labour MP Jess Asato is suing Elon Musk’s xAI after Grok users generated and shared non-consensual sexualized images and videos depicting her.
⠀
The content appeared after Asato publicly criticized Grok for being used to create sexualized deepfakes of women and children. It included fabricated bikini images and a disturbing video depicting her being prepared for a sexual assault.
⠀
Asato said she repeatedly reported the material to X but was initially told it did not violate the platform’s rules. The content was removed after her lawyer contacted the company.
⠀
Her High Court claim alleges breaches of UK data-protection law and misuse of private information, arguing that xAI processed her face and likeness without consent.
⠀
Asato is also seeking an order preventing Grok from generating further non-consensual sexualized images of her. The case could help establish how AI companies are held responsible when their tools are used to create abusive deepfakes.

Source: https://www.wired.com/story/the-big-interview-podcast-jess-asato/

🚨🇺🇸 Microsoft Authenticator flaw allowed malicious ...

2026-10-27T17:27:45Z

🚨🇺🇸 Microsoft Authenticator flaw allowed malicious Android apps to steal work account tokens

Tracked as CVE-2026-80097, the high-severity vulnerability allowed an Android app with no permissions to impersonate trusted Microsoft apps such as Teams and request tokens for a work account signed into Authenticator.
⠀
Researchers demonstrated that the stolen tokens could provide access to:

• Email and the ability to send messages
• Files stored in Microsoft services
• Calendars and Teams chats
• Authentication methods and passkey management
⠀
The flaw existed because Authenticator trusted identity information supplied by the requesting app instead of confirming which app actually made the request.
⠀
Microsoft rates the vulnerability 8.6 and says exploitation requires a malicious app on the device and user interaction during authentication. However, researchers reported obtaining tokens without further interaction when a work account was already signed in.
⠀
Microsoft says it has found no evidence of exploitation. The issue affects Authenticator for Android versions before 6.2606.4246.

Users should update to version 6.2606.4246 or later.

Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097

🚨🇭🇰 Keystone to destroy 18,835 hardware wallets after ...

2026-10-27T17:11:29Z

🚨🇭🇰 Keystone to destroy 18,835 hardware wallets after authentication key theft

Keystone says an attacker breached its website and stole the cryptographic key used to verify that its hardware wallets are genuine.
⠀
The stolen key could allow counterfeit wallets to pass Keystone’s official authenticity check, potentially exposing users to cryptocurrency theft. The key cannot be replaced on devices that have already been manufactured, forcing the company to destroy 18,835 unsold wallets and suspend pending shipments.
⠀
The attacker exploited a vulnerability in a third-party data monitoring tool and also accessed 25,964 buyer records containing names, contact details, shipping addresses and order information.
⠀
Another 12,873 unpaid checkout records were potentially exposed. Some customer data should have already been erased under Keystone’s 180-day retention policy, but an automated deletion tool had failed.
⠀
Keystone says recovery phrases, private keys and payment information were not compromised.

Customers who received a device using the old authentication key after October 20 should contact Keystone for additional verification. The company is not recalling devices and warns that anyone asking customers to return a wallet may be attempting a phishing scam.

Source: https://thedefiant.io/news/security/keystone-to-destroy-18-835-wallets-after-device-authentication-key-theft

🚨🇫🇷 ENGIE confirms customer data stolen from partner ...

2026-10-27T16:46:50Z

🚨🇫🇷 ENGIE confirms customer data stolen from partner marketing platform

French energy giant ENGIE says attackers gained access to a platform used by business partners for customer prospecting and marketing energy offers.
⠀
The exposed information includes:

• Names
• Mailing addresses
• Email addresses
• Phone numbers
• Customer IDs
• Contract numbers
• Electricity delivery or gas metering point references
⠀
ENGIE says no banking information was affected and its internal IT systems were not compromised. The company blocked the unauthorized access, notified authorities and contacted affected customers in France.
⠀
The number of affected customers and the identity of the compromised platform have not been disclosed.

No ransomware or extortion group has publicly claimed responsibility as of this post.

Source: https://www.bleepingcomputer.com/news/security/energy-giant-engie-discloses-data-breach-affecting-customers/

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being ...

2026-10-27T16:29:45Z

🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks

CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation.
⠀
Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.

Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk.
⠀
Both vulnerabilities have a CVSS 4.0 score of 9.2.

Fixed versions:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35
⠀
CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.

The PHP team says there are no complete mitigations and that updating is the only safe solution.

Source: https://www.cisa.gov/news-events/alerts/2026/10/26/cisa-adds-two-known-exploited-vulnerabilities-catalog

🚨 Virtualine: An offshore hosting provider offering ...

2026-10-27T15:22:59Z

🚨 Virtualine: An offshore hosting provider offering bulletproof hosting services has reportedly been seized by the FBI. There is no press release at this time.

🚨🇨🇳 Chinese defense technology firm Jingan Tech ...

2026-10-27T15:02:20Z

🚨🇨🇳 Chinese defense technology firm Jingan Tech allegedly breached, source code and government project files exposed

Hangzhou Jingan Technology, a Chinese company specializing in advanced defense technology, infrastructure security, urban security, and national defense systems, has been named in a data leak.

The actor "Aku" claims to possess 2.85 GB of compressed data containing proprietary source code and files related to government projects.

The actor reportedly attempted to sell the information privately but decided to release a portion after negotiations with a potential buyer broke down.

The alleged breach dates to October 2026. The authenticity of the files and the extent of the compromise remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇩🇰 University of Copenhagen data breach exposes ...

2026-10-26T23:52:45Z

🚨🇩🇰 University of Copenhagen data breach exposes information belonging to 525,000 people

Hackers gained access to a university test environment containing full names, Danish national identity numbers, work and private telephone numbers, and personal email addresses.
⠀
PIN codes used with the ID cards of around 20,000 staff members and students were also compromised. The university replaced the affected codes and temporarily restricted access to selected critical locations.
⠀
The attack was detected on October 20 and has since been contained. The university says there is no indication that the hackers reached systems supporting daily operations or disrupted its activities.
⠀
The incident has been reported to the Danish Data Protection Agency and other relevant authorities. The university is still investigating the full scope of the breach.

Source: https://news.ku.dk/all_news/2026/10/university-of-copenhagen-hit-by-cyber-attack/

‼️🇺🇸 BYOD is doubling down on its claim against the ...

2026-10-26T23:23:18Z

‼️🇺🇸 BYOD is doubling down on its claim against the University of New Mexico, stating that the stolen data is up for grabs and that the university can purchase its own data, along with the decryption key for its files.

CVE-2025-24071: Simply extracting a .rar archive containing a ...

2026-10-26T22:36:43Z

CVE-2025-24071: Simply extracting a .rar archive containing a malicious .library-ms file can cause Windows Explorer to initiate an outbound SMB authentication request, potentially exposing the user's NTLM hash. No further interaction is required after extraction.

Exploit and Video Credit to @0x6rss:

https://github.com/0x6rss/CVE-2025-24071_PoC

👀🚨🇫🇷 Vulnerability allegedly exposes personal data of ...

2026-10-26T21:52:14Z

👀🚨🇫🇷 Vulnerability allegedly exposes personal data of up to 15 million people in France

An actor using the handle "Vagrantly" is selling exclusive access to an unauthenticated API endpoint containing approximately 50 million identifiers.

The endpoint reportedly exposes names, phone numbers, email addresses, residential addresses, and, in some cases, vehicle license plates.

After testing over 100,000 identifiers, the actor claims roughly 33% returned personal information, suggesting as many as 15 million records could be accessible.

The endpoint is rate-limited, making large-scale extraction time-consuming. The actor is offering access to a single buyer rather than extracting the data themselves.

The vulnerability and potential exposure remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

‼️🇺🇸 University of New Mexico has been named by BYOD ...

2026-10-26T21:38:45Z

‼️🇺🇸 University of New Mexico has been named by BYOD ransomware

The full post reads:

36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 French Handisport Federation records shared online, ...

2026-10-26T20:41:48Z

🚨🇫🇷 French Handisport Federation records shared online, approximately 5,000 entries advertised

The French Handisport Federation (FFH), which oversees sports for athletes with physical and sensory disabilities in France, has had information linked to its members and affiliated clubs shared online.

The actor "camillelelouche" published data described as scraped from the federation, including names, email addresses, phone numbers, dates of birth, sports affiliations, license information, and disability classifications.

Sample records have been provided, with the dataset offered for free. There is currently no confirmation of a breach of the federation's internal systems.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 TropiPay allegedly breached, customer credentials and ...

2026-10-26T20:36:23Z

🚨 TropiPay allegedly breached, customer credentials and financial identity records exposed

TropiPay, an online financial platform used to send, receive, and manage money, has been named in a data leak by the actor "Emzywemzy".

The actor claims the breach occurred on October 13, 2026, affecting 294,998 users.

The published listing references more than 1.1 million client records, 339,691 credential entries, 100,865 verification records, and 11,236 merchant records.

Exposed information reportedly includes names, email addresses, phone numbers, physical addresses, dates of birth, password data, and KYC verification details.

Samples containing email and password combinations have been displayed. The authenticity and extent of the breach remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 DreamHost forces email and FTP/SFTP password resets during ...

2026-10-26T20:14:21Z

🚨 DreamHost forces email and FTP/SFTP password resets during ongoing incident

DreamHost has expired passwords for some email and FTP/SFTP users following an incident affecting its webmail and File Manager services.
⠀
The company says all impacted account owners have now been emailed instructions. Affected users will remain unable to access their email or files until the account owner creates new passwords and shares the credentials with them.
⠀
DreamHost has not disclosed the cause of the incident, whether any data was accessed or how many customers were affected.

Its browser-based File Manager also remains unavailable as restoration work continues.
⠀
Account owners should go directly to panel.dreamhost.com and reset credentials under:

• Mail > Manage Email
• Websites > SFTP Users & Files

DreamHost warns that it will never request passwords by email or direct customers to sign in through an emailed link.

Sources: https://www.dreamhoststatus.com/

CNET is livestreaming on TikTok, repeatedly folding and unfolding ...

2026-10-26T20:03:58Z

CNET is livestreaming on TikTok, repeatedly folding and unfolding the iPhone Duo.

https://www.tiktok.com/@cnetdotcom/live

CVE-2026-40369: An unprivileged arbitrary 12-byte kernel write ...

2026-10-26T19:41:47Z

CVE-2026-40369: An unprivileged arbitrary 12-byte kernel write primitive exists in nt!ExpGetProcessInformation and can be reached from any context capable of calling NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderer processes.

PoC and Writeup 👇

PoC: https://github.com/orinimron123/CVE-2026-40369-EXPLOIT

Writeup and Video Credit: https://voidsec.com/cve-2026-40369-browser-sandbox-escape/

🚨 Medkey EHR is vulnerable to an IDOR that can expose other ...

2026-10-26T19:14:23Z

🚨 Medkey EHR is vulnerable to an IDOR that can expose other patients’ records; CVE-2026-12207

PoC: https://github.com/r0xkrnl/Medkey-EHR-IDOR-PoC

The flaw affects Medkey’s REST API and stems from insufficient authorization checks in the patient lookup functionality. An authenticated user can manipulate a patient ID value and retrieve records belonging to other patients.

CVSS: 4.3 Medium
Impact: Unauthorized access to patient information
Affected: Medkey rolling-release builds through commit fc09b7ba9441ff590b72d428d5380834216b09ed

The issue is tracked as CWE-99, Improper Control of Resource Identifiers, and can be exploited remotely with low privileges and no user interaction.

‼️🇨🇷 WhiteArmor claims access to Gamdom’s full user ...

2026-10-26T18:50:20Z

‼️🇨🇷 WhiteArmor claims access to Gamdom’s full user database and is demanding $15 million in Bitcoin.

🇨🇷 Gamdom - An online casino and sportsbook founded in 2016, offering crypto-based casino games, sports betting, and esports wagering.

The listing claims 15,420,003 user accounts across 146 database columns, with combined account profit values exceeding $1 billion.

WhiteArmor says access came through an internal machine account with administrative privileges and has published a sample of 100 accounts as proof.

The authenticity and the extent of the alleged compromise have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

A user on Dread is promoting Dark Empire RPG, a browser-based ...

2026-10-26T18:34:53Z

A user on Dread is promoting Dark Empire RPG, a browser-based multiplayer cyberpunk RPG built with PHP, HTML/CSS and Python. The game features a marketplace, crafting, guilds, territory wars and law-enforcement career paths.

Dread Announcement: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/bc7cbb5e64f166778e4c

Dark Web: http://kd67wsybyev4mxqbizgw2hizs76jezqgc5eea5b6k7ftccfc65qeibid[.]onion/

"Defcon" has been added to the OpSec Failures page. ...

2026-10-26T18:11:23Z

"Defcon" has been added to the OpSec Failures page.

Direct file: https://darkwebinformer.com/opsec-failures/#file-defcon

🚨 PHP releases new Windows builds to fix critical HTTP2Shell ...

2026-10-26T17:59:56Z

🚨 PHP releases new Windows builds to fix critical HTTP2Shell vulnerability

The PHP team has rebuilt its supported Windows packages with Brotli 1.2.1, addressing CVE-2026-111497, an out-of-bounds write flaw that can potentially lead to remote code execution.
⠀
In PHP’s Windows builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled.

This cURL feature is disabled by default, but applications and HTTP client libraries can turn it on.
⠀
Updated builds:

• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1
⠀
The “-1” suffix indicates that the Windows packages were rebuilt with updated dependencies. The PHP source and runtime version numbers remain unchanged.

This is separate from the PHP2Shell flaws patched on October 21.

Source: https://www.php.net/archive/2026.php

🚨 Crimeflare releases emergency WAF rules for critical Brotli ...

2026-10-26T17:19:30Z

🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability

Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint.
⠀
The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution.

It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases.
⠀
Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action.

Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement.
⠀
Node.js users should update to:

• 22.23.4
• 24.22.1
• 26.12.1

The WAF rules are an additional mitigation, not a replacement for patching.

Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release

🚨 Microsoft issues emergency .NET updates after earlier ...

2026-10-26T16:54:18Z

🚨 Microsoft issues emergency .NET updates after earlier patches failed to fully fix two vulnerabilities

Microsoft says its October 13 updates did not completely address CVE-2026-102870 and CVE-2026-70197, prompting new out-of-band security releases for .NET 8, 9, 10 and 11.
⠀
CVE-2026-102870 is a high-severity remote code execution flaw in the Blazor WebAssembly debugger.

Attacker-controlled data from a debugged application could escape a generated C# string and execute code on a developer’s computer when they evaluate an expression. The vulnerability has a CVSS score of 8.8 and requires user interaction.
⠀
The emergency updates also address:

• CVE-2026-70197, a SocketAsyncEventArgs memory corruption flaw
• CVE-2026-111497, a Brotli decoder out-of-bounds write
• CVE-2026-114148, a Linux source-build tarball ownership issue
⠀
Microsoft warns that updating the shared .NET runtime alone is not enough to fix the Blazor vulnerability when affected NuGet packages are referenced directly.

Developers should update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including version 10.0.14 for .NET 10 projects.

Source: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates

‼️ New Dark Web Informer Blog Post! Title: ACTIL Dataset ...

2026-10-26T16:41:05Z

‼️ New Dark Web Informer Blog Post!

Title: ACTIL Dataset Claim Lists 152,187 Records With Patient, Prescription and Reimbursement Data

Link: https://darkwebinformer.com/actil-dataset-claim-lists-152-187-records-with-patient-prescription-and-reimbursement-data/

💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing

🚨 Two critical Wasmtime flaws could allow malicious ...

2026-10-26T16:26:22Z

🚨 Two critical Wasmtime flaws could allow malicious WebAssembly modules to escape the runtime sandbox

Both vulnerabilities affect Cranelift, Wasmtime’s default compiler, and carry CVSS scores of 9.9.
⠀
CVE-2026-115889 affects all processor architectures and can trigger silent compiler errors that generate incorrect machine code.

CVE-2026-115893 affects ARM64 systems and can cause large br_table instructions to jump to the wrong code location.
⠀
Exploitation requires a vulnerable Wasmtime instance to compile an attacker-controlled WebAssembly module. Services that accept and execute untrusted customer modules face the greatest risk.

Fixed versions:

• Wasmtime 36.0.19
• Wasmtime 48.0.7
• Wasmtime 49.0.4
• Wasmtime 50.0.0 or later

No exploitation in the wild has been reported.

Sources: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm

https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm

🚨 Eight Apache Camel flaws expose systems to code execution, ...

2026-10-26T16:01:58Z

🚨 Eight Apache Camel flaws expose systems to code execution, authentication bypass and data theft

The highlighted vulnerabilities include two critical Camel K flaws and six high-severity issues affecting components such as JGroups, Spring Redis, OAuth, HTTP and Smooks.
⠀
Potential impacts include:

• Remote code execution through unsafe deserialization
• Arbitrary Kubernetes object deployment
• Code execution inside the Camel K operator pod
• Authentication bypass after failed OAuth checks
• Exposure of vault secrets and configuration values
• Credential theft through malicious HTTP redirects
• Local file disclosure through XML external entities
⠀
Affected deployments should upgrade Apache Camel to 4.18.5, 4.22.1 or 4.23.0 and Camel K to 2.9.3, 2.10.2 or 2.11.0.

Exploitability depends on the components and configurations in use. There is currently no confirmed evidence of exploitation in the wild.

Sources:
https://camel.apache.org/blog/2026/10/camel-security-advisories-4.23.0/

🚨🇦🇪 Reze ransomware begins leaking documents allegedly ...

2026-10-26T15:41:13Z

🚨🇦🇪 Reze ransomware begins leaking documents allegedly stolen from Dubai International Financial Centre (DIFC)

The Reze ransomware group has published a new batch of files linked to DIFC, a major financial hub in Dubai, following an earlier $5 million ransom demand.

The release includes documents labeled as passport copies, visa records, work permits, telecommunications approvals, and contact information.

Reze warns that it will continue publishing additional files daily, accusing DIFC of ignoring the breach.

The authenticity of the documents and the extent of the alleged compromise have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇳🇱 Dutch police arrest two suspects over NFC relay ...

2026-10-26T15:26:33Z

🚨🇳🇱 Dutch police arrest two suspects over NFC relay fraud that stole €380,000 from 170 victims

Police say victims received calls using AI-generated audio that warned of suspicious activity on their bank accounts. A fake bank employee then instructed them to install an app and hold their payment card against the phone.
⠀
The app relayed data from the card’s NFC chip to an accomplice waiting at an ATM, allowing cash to be withdrawn from the victim’s account in real time.

A 23-year-old from Vaassen allegedly developed the technical infrastructure and directed others, while a 25-year-old from Ede is accused of coordinating the operation.
⠀
Both were arrested on October 6. Police took the servers offline and seized phones and laptops during the investigation.

Source: https://www.politie.nl/headless-api/nieuws/2026/oktober/20/07-twee-verdachten-aangehouden-in-onderzoek-naar-nieuwe-vorm-van-bankhelpdeskfraude.html

🚨🇨🇭 Swiss Ice Hockey Federation data offered for sale, ...

2026-10-26T15:17:22Z

🚨🇨🇭 Swiss Ice Hockey Federation data offered for sale, over 87,000 people potentially affected

The Swiss Ice Hockey Federation (SIHF), which oversees ice hockey competitions and national teams in Switzerland, has been named in a data leak listing by the actor "weykofa".

The advertised 6.9 GB archive contains 46 files and reportedly includes 540,287 entries associated with 87,226 individuals.

Among the records are 37,339 email addresses, 6,510 phone numbers, and 656 IBANs, potentially exposing personal and financial information.

The seller is accepting offers in Bitcoin and Monero. The authenticity and origin of the files have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇰🇼 Taly customer data allegedly leaked, personal ...

2026-10-26T15:04:40Z

🚨🇰🇼 Taly customer data allegedly leaked, personal information offered for sale

Taly, a buy now, pay later (BNPL) service, has been named in a data breach listing by the actor "brownbull01".

A published sample contains customer names, email addresses, Kuwaiti phone numbers, and detailed residential information, including neighborhoods, streets, building blocks, floors, and apartment numbers.

The seller claims the data originates from a 2026 breach and is offering it to interested buyers. No total record count was disclosed, and the source of the information remains unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Kali Linux 2026.3 released with Linux kernel 7.1.5, new ...

2026-10-26T14:50:49Z

🚨 Kali Linux 2026.3 released with Linux kernel 7.1.5, new tools and major NetHunter updates

The release refreshes Kali’s image-building scripts with consistent options across platforms and adds support for building inside Docker or Podman containers.
⠀
Kali 2026.3 also introduces KDE Plasma 6.7, 126 package updates and six new tools:

• dalfox
• katana
• qsreplace
• rustscan
• sdrangel
• snaffler-ng
⠀
NetHunter now supports wardriving from TicWatch Pro 3 devices, phone-based control of NetHunter watches, NFC card operations and KernelSU.

Source: https://www.kali.org/blog/kali-linux-2026-3-release/

🚨🇬🇧 Tipping Point UK and Pull The Plug UK targeted in ...

2026-10-26T14:41:51Z

🚨🇬🇧 Tipping Point UK and Pull The Plug UK targeted in alleged internal data leak

A user operating under the handle "p9m" has published an archive allegedly containing internal records from Tipping Point UK, a workers' cooperative supporting activist campaigns across the United Kingdom.

The release follows an apparent dispute involving Pull The Plug UK, an anti-AI data centre campaign.

The 671-file archive reportedly includes 10 databases containing 48 tables, along with 107 internal wiki documents.

Exposed material allegedly covers campaign strategies, donor information, staff records, activist contacts, internal communications, financial documents, and media outreach plans.

The files have been made publicly available, although their authenticity has not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Microsoft 365 token replay campaign compromises 97 accounts ...

2026-10-26T14:34:25Z

🚨 Microsoft 365 token replay campaign compromises 97 accounts across 79 organizations

Huntress tracked more than 200,000 login attempts and 497 successful sign-ins during the campaign, which ran from July 14 to September 22.
⠀
Attackers used adversary-in-the-middle phishing pages to steal authenticated Microsoft sessions, allowing them to bypass MFA by replaying the captured tokens from their own systems.

After gaining access, the attackers registered at least 48 rogue Entra devices, replaced victims’ MFA methods and created hidden inbox rules to conceal messages involving payroll, direct deposits, banking and bonuses.
⠀
In 19 organizations, existing MFA methods were removed and replaced within three hours of the initial compromise.

Organizations should revoke affected sessions, reset passwords, audit Entra devices and MFA methods, review inbox rules and restrict device-code authentication through Conditional Access.

Source: https://www.huntress.com/blog/token-replay-spray

👀🚨🇩🇴 Dominican Republic government agency CONAPE ...

2026-10-26T00:40:05Z

👀🚨🇩🇴 Dominican Republic government agency CONAPE allegedly suffers massive data leak involving 6 million records

A dataset linked to the National Council for the Aging (CONAPE), the Dominican government agency responsible for supporting older adults, has surfaced online.

The actor "sqx" claims the files contain 6 million records, including national ID numbers, names, dates of birth, residential addresses, phone numbers, and family information.

More concerning is the reported exposure of medical conditions, medications, disability information, pension details, and government assistance records.

Samples showing detailed individual profiles have been published. The origin and authenticity of the dataset have not been independently confirmed.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 KeePassXC 2.8.0 is out with several security fixes and a ...

2026-10-26T00:29:02Z

🚨 KeePassXC 2.8.0 is out with several security fixes and a major move to Qt 6

Release: https://github.com/keepassxreboot/keepassxc/releases

https://keepassxc.org/download

The update fixes CVE-2026-69150, a use-after-free triggered when importing a crafted legacy KDB file, along with multiple additional browser integration, memory safety, and Windows security issues that are still awaiting CVE assignments.

Security fixes include:

• Crafted KDB import use-after-free
• Browser entry reference injection
• Out-of-bounds writes in native messaging
• Weak Pageant shared-memory mapping names on Windows
• Integer overflow and out-of-bounds read in the legacy KDB importer
• Improved clearing of decrypted database fragments from memory

KeePassXC 2.8.0 also adds remote database synchronization, configurable shortcuts, SSH key generation, Wayland Auto-Type support, Linux Quick Unlock, and native Windows Arm64 builds.

Made some more prompt changes to the Threat Feed. It should now ...

2026-10-26T00:08:31Z

Made some more prompt changes to the Threat Feed.

It should now produce better titles and descriptions, while also improving category and country accuracy.

🚨🇺🇸 Initial Access: Ryder Invoicing Portal Threat actor ...

2026-10-25T23:43:16Z

🚨🇺🇸 Initial Access: Ryder Invoicing Portal

Threat actor "ShadowByt3$" is advertising access to Ryder’s invoicing portal, which they describe as part of a corporate Electronic Invoice Presentment and Payment environment.

The access is listed for $300, with payment accepted in BTC or XMR through escrow. The actor also shared screenshots as alleged proof of access.

This claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Graphcom allegedly breached, source code and ...

2026-10-25T23:03:08Z

🚨🇫🇷 Graphcom allegedly breached, source code and database backups exposed

Graphcom, a French digital signage and visual communications company, has been targeted by the actor "888", who claims to have maintained access to its systems for more than 24 hours.

The alleged breach involves source code, Microsoft SQL Server backups, SQL files, hardcoded credentials, and configuration files.

Screenshots published by the actor show access to Azure DevOps repositories, SQL Server databases, and MinIO object storage containing backup files.

The actor has also posted files for download. The full extent of the intrusion has not been independently confirmed.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

👀‼️🇧🇷 WhiteArmor publishes data allegedly taken from ...

2026-10-25T22:36:14Z

👀‼️🇧🇷 WhiteArmor publishes data allegedly taken from Brazil’s Partido Liberal.

🇧🇷 Partido Liberal (PL) - A Brazilian political party active at the federal, state, and municipal levels.

The listing states the data is now available publicly and claims 114 GB of files were released.

The Hack That Exposed Hollywood’s Most Private Photos In 2014, ...

2026-10-25T21:37:06Z

The Hack That Exposed Hollywood’s Most Private Photos

In 2014, private photos of Jennifer Lawrence, Kate Upton, and more than 100 other celebrities were leaked online in one of the most infamous privacy breaches in internet history.

The incident, dubbed "The Fappening," wasn't the result of sophisticated hacking techniques. Instead, attackers used convincing phishing emails disguised as Apple security alerts to trick victims into handing over their login credentials.

What followed was a massive invasion of privacy, exposing just how easily personal information could be stolen and how nearly impossible it was to erase once it spread online.

This is the story behind the scandal that shook Hollywood and raised serious questions about digital privacy.

Video Credit: youtube.com/@Blackfiles-HD

🚨🇰🇭 Cambodia Academy of Digital Technology and Institute ...

2026-10-25T20:04:44Z

🚨🇰🇭 Cambodia Academy of Digital Technology and Institute of Digital Technology allegedly breached, sensitive files leaked

The actor "DaOnlySpark" has released a second batch of files allegedly stolen from Cambodia's Academy of Digital Technology (CADT) and Institute of Digital Technology (IDT).

The actor says they exploited a remote code execution (RCE) vulnerability to access internal systems, obtaining SQL databases, application source code, employee documents, student records, and payment information.

The leak also reportedly contains sensitive credentials, including Microsoft 365, Google, OpenAI, and payment API credentials, along with SSH keys, OAuth secrets, and Firebase service account keys.

Among the exposed files are internal GitHub repositories, employee identity documents, CRM records, financial logs, and administrator password hashes.

The extent of the compromise has not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇹🇼 PopChill allegedly breached, data on 435,000 users ...

2026-10-25T19:45:11Z

🚨🇹🇼 PopChill allegedly breached, data on 435,000 users exposed

PopChill, a Taiwanese marketplace for secondhand luxury fashion, has appeared in a data leak shared by the actor "DaOnlySpark".

The files reportedly contain 435,015 user records, 439 business accounts, and 8,539 phone number records.

Exposed information includes usernames, display names, profile photos, phone verification status, account activity, and seller details. Approximately 15,500 accounts are marked as ID-verified.

The actor says the breach occurred on October 21, 2026. The authenticity of the data has not been confirmed.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸🇺🇸🇦🇺 Initial Access: Three Corporate and ...

2026-10-25T18:40:35Z

🚨🇺🇸🇺🇸🇦🇺 Initial Access: Three Corporate and Public-Sector Environments

Threat actor "Glitch NoOp" is advertising access to three organizations across the U.S. and Australia.

🇺🇸 Consumer services company in California - RDWeb access with Domain User privileges, internal service management systems, 51-200 employees, and approximately $13M in revenue.

🇺🇸 K-12 public school district in Tennessee - Compromised corporate VPN/remote portal access with Domain User privileges and visibility into approximately 1,000 internal hosts across multiple campuses.

🇦🇺 Professional business services firm - Compromised corporate VPN access with Domain User privileges, approximately 360 active hosts, centralized databases and advisory portals, and around $31.5M in revenue.

Claims are currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Delatad allegedly breached, sensitive client ...

2026-10-25T18:18:48Z

🚨🇫🇷 Delatad allegedly breached, sensitive client requests and personal information exposed

Delatad, a French service that helps individuals remove personal information, photos, and videos from the internet, has been targeted by the actor "suicid".

The actor claims to have compromised the company's administration panel and obtained client inquiries containing names, email addresses, phone numbers, and sensitive requests involving online content removal.

The actor also claims to have abused Delatad's SMTP server to send emails to clients and prospective customers.

Sample records and download links have been published. The breach remains unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Researcher publishes 11 unpatched security flaws affecting ...

2026-10-25T15:58:52Z

🚨 Researcher publishes 11 unpatched security flaws affecting Tailscale and headscale

Erica Windisch of Cyberdione Labs skipped coordinated vulnerability disclosure and publicly released details for 11 flaws tested against Tailscale 1.104.2 and headscale 0.29.5.

The reported issues involve Tailscale SSH, Unix socket forwarding, App Connectors, Serve and Funnel. The most serious could allow an authorized Tailscale SSH user to gain root-level capabilities on a destination system through port forwarding.
⠀
Windisch said the findings were reported but not coordinated with Tailscale before publication.

Tailscale confirmed it received the report and had independently identified issues it is now working to fix. The company said the full scope remains under investigation and is not currently advising everyone to disable Tailscale SSH.

Research: https://tailworm.com/

Tailscale response: https://www.reddit.com/r/Tailscale/comments/1xeoj1l/recent_tailscale_vulnerability_reports/

‼️🇺🇸 Astrana Health appears in a new leak-site listing ...

2026-10-25T15:27:05Z

‼️🇺🇸 Astrana Health appears in a new leak-site listing involving internal financial, regulatory, operational, and employee data.

🇺🇸 Astrana Health - A U.S.-based healthcare services company focused on physician networks, care delivery, and value-based healthcare management.

The listing claims 738 GB of uncompressed data, 470 GB compressed, including internal documents, regulatory audit reports, payer financial dispute trackers, operational readiness reviews, acquisition pipelines, reimbursement tables, regulatory notifications, funds-transfer records, company financial statements, user credential lists, client contact lists, and employee PII.

Nostr event nevent1qqsypele25t5nttgxj5v4dn76u4qsenv07e5lex227kv6wlu2vswe8czyqmq9cayrv6fgmvpcqrleadwpk4wykvhknsykyr7stjk5zgvpkdczuwllc4

2026-10-25T14:59:27Z

Dread has been disabled temporarily from the threat feed.

Threat actor starter pack: $50K in designer accessories, $12 in ...

2026-10-25T01:41:05Z

Threat actor starter pack: $50K in designer accessories, $12 in OPSEC.

Added another forum to the threat feed... this one is a carding ...

2026-10-25T01:11:58Z

Added another forum to the threat feed... this one is a carding forum.

🚨🇫🇷 Over 905,000 French vehicle registration records ...

2026-10-25T00:17:29Z

🚨🇫🇷 Over 905,000 French vehicle registration records allegedly exposed, with personal information attached

The actor "ChimeraZ" is selling a 175 MB dataset containing 905,097 records, including 847,064 unique license plates, 506,003 email addresses, and 474,906 phone numbers.

The records link vehicle registration numbers to names, residential addresses, and contact information.

The actor has released 1,000 sample records but is withholding the name of the affected website until its alleged vulnerabilities are fixed.

Another batch containing approximately 2 million license plates is also being teased. The claims remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 A crafted OpenAPI document can turn generated TypeScript ...

2026-10-24T23:48:38Z

🚨 A crafted OpenAPI document can turn generated TypeScript clients into a code execution path; CVE-2026-108551

PoC: https://github.com/Zombie-Kaiser/CVE-2026-108551-POC

The flaw affects openapi-typescript-codegen and stems from unsafe interpolation inside Handlebars templates. An attacker who controls an OpenAPI document can inject JavaScript through values such as path keys, parameter names, server URLs, or version fields.

CVSS: 9.3 Critical Affected: openapi-typescript-codegen ≤ 0.31.0 Impact: Arbitrary JavaScript execution when generated clients are imported or affected service methods are called

The PoC demonstrates how malicious OpenAPI input can survive client generation and execute once the generated code is used.

🚨 Exploit published for a critical Adobe Commerce and Magento ...

2026-10-24T23:24:23Z

🚨 Exploit published for a critical Adobe Commerce and Magento Open Source account takeover vulnerability; CVE-2026-71362

Exploit: https://github.com/mahumadad/cve-2026-71362-magento-ato

The flaw is an incorrect authorization issue that can allow an attacker to manipulate customer-session identity state and gain access to another customer's account without knowing their password.

Adobe rates the issue as critical and says exploitation requires no authentication or user interaction.

CVSS: 9.1 Critical
Affected: Adobe Commerce and Magento Open Source through the July 2026 isolated-patch level
Fixed: August 2026 isolated-patch level

Successful exploitation can expose customer PII, orders, addresses, and stored payment-related data associated with the compromised account.

🚨Initial Access: Two Corporate GlobalProtect VPN Listings A ...

2026-10-24T22:35:56Z

🚨Initial Access: Two Corporate GlobalProtect VPN Listings

A threat actor is advertising GlobalProtect SSL/VPN access to two unnamed companies.

🌏 Asia - Engineering company with approximately 2,000 employees and $250M in revenue. The actor shared connection logs indicating the VPN tunnel successfully established.

🌎 LATAM - Manufacturing company with 50-200 employees and $50M in revenue. The actor claims the company has major technology partners and large investors.

Both accesses reportedly remain largely unexplored to avoid alerting the targets.

Claims are currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 PoC published for a critical unauthenticated Fortinet ...

2026-10-24T20:32:38Z

🚨 PoC published for a critical unauthenticated Fortinet FortiSIEM remote code execution vulnerability; CVE-2026-106173

PoC: https://github.com/horizon3ai/CVE-2026-106173

The flaw affects FortiSIEM's gRPC QueryResultReq handler. Improper validation of attacker-controlled metadata allows path traversal and arbitrary file writes, which can be chained into remote code execution by overwriting files that are later executed by the system.

CVSS: 9.4 Critical
Affected: FortiSIEM 7.0.0 through 7.5.0 across multiple release branches
Fixed: FortiSIEM 7.5.1 or 7.6.0 and later

The PoC targets the exposed gRPC service on TCP/27918 and demonstrates blind command execution through the arbitrary file-write chain.

🚨🇫🇷 Renaissance, Emmanuel Macron's political party, ...

2026-10-24T20:16:22Z

🚨🇫🇷 Renaissance, Emmanuel Macron's political party, hit by alleged 4.1 million-record data leak

The actor "ChimeraZ" has published 4,157,404 records linked to Renaissance, the French political party founded by President Emmanuel Macron.

The files cover door-to-door canvassing operations, 373,906 addresses, campaign events, and information on 1,547 staff members.

Member records and internal campaign planning data are also included. Multiple download mirrors have been published, although the authenticity of the material remains unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

This video tells the story of Malone Lam, a 20-year-old from ...

2026-10-24T19:43:15Z

This video tells the story of Malone Lam, a 20-year-old from Singapore who helped steal over $230 million worth of Bitcoin through an elaborate social engineering scam. No sophisticated hacking tools or complex code, just deception, impersonation, and a convincing scheme.

From scamming Minecraft players to tricking a wealthy cryptocurrency investor into handing over access to his Bitcoin, Lam's activities escalated into one of the largest cryptocurrency thefts in history. The stolen fortune funded an extravagant lifestyle filled with luxury cars, lavish mansions, private jets, and nightclub bills reaching hundreds of thousands of dollars.

But the spending spree eventually attracted the attention of federal investigators, leading to arrests and a sprawling investigation into where the stolen Bitcoin went, much of which remains unaccounted for.

Video Credit: youtube.com/@InVoyceYT

🚨 RugWhales introduces new cryptocurrency wallet drainer ...

2026-10-24T17:31:00Z

🚨 RugWhales introduces new cryptocurrency wallet drainer targeting seed phrases

A new Drainer-as-a-Service (DaaS) operation called "RugWhales" is advertising a seed phrase drainer designed to empty cryptocurrency wallets across multiple blockchain networks.

The tool claims to search wallet derivation paths, transfer assets automatically, and imitate wallet extension prompts from MetaMask, Trust Wallet, Ledger, Phantom, and others.

It also offers fake airdrop prompts, customizable phishing interfaces, and support for Ethereum, Solana, Bitcoin, TRON, and other networks.

RugWhales is currently recruiting closed beta testers, with a standard 20% commission planned after launch. Its advertised capabilities remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇺🇸 Wisconsin man charged after online child abuse tips ...

2026-10-24T16:27:57Z

🚨🇺🇸 Wisconsin man charged after online child abuse tips led investigators to his home

Steven Steele, 27, of Ladysmith, faces felony charges for allegedly possessing child sexual abuse material.
⠀
The investigation began after Wisconsin’s Division of Criminal Investigation received CyberTipline reports from the National Center for Missing & Exploited Children.

Investigators later searched Steele’s residence and seized electronic devices as evidence.

Source: https://drydenwire.com/news/rusk-county-man-charged-after-online-child-abuse-tips-lead-to-search/

🚨🇷🇴 Valmand targeted in alleged breach, 14,000 luxury ...

2026-10-24T16:14:46Z

🚨🇷🇴 Valmand targeted in alleged breach, 14,000 luxury customer records at risk

"OnionSec" claims to have compromised Valmand, a Romanian luxury jewelry retailer, on October 22, obtaining customer information and confidential company documents.

The alleged stolen data includes names, phone numbers, delivery addresses, and purchase histories involving engagement rings, diamonds, and other high-value jewelry.

Internal communications, executive contact details, and financial documents were also reportedly taken.

The actor is demanding €60,000 in Monero (XMR), threatening to publish the records if the company refuses to pay.

Sample evidence has been posted, but the breach remains unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇴🇲 PHP2Shell Initial Access Claim: Oman's energy ...

2026-10-24T15:43:00Z

🚨🇴🇲 PHP2Shell Initial Access Claim: Oman's energy infrastructure access advertised for $35,000

An actor using the handle "NanC" is offering what they describe as full access to an unidentified energy infrastructure organization in Oman.

The listing advertises PHP web shell access and database access, with a price of 35,000 USDT and escrow required for the transaction.

No technical evidence, affected systems, or organization name were disclosed. The access claim remains unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 DEKRA France inspection records allegedly leaked The ...

2026-10-24T15:20:37Z

🚨🇫🇷 DEKRA France inspection records allegedly leaked

The actor "Syrv4x" has released 16,171 records linked to DEKRA, an international company providing testing, inspection, and certification services.

The 16 MB dataset contains customer names, addresses, phone numbers, email addresses, inspection dates, technician details, work reports, and service records.

Sample entries include inspection and maintenance information for heating and air-conditioning systems.

The files have been made available for free. Their authenticity has not been independently confirmed.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇦🇪 Dubai Land Department data allegedly compromised, ...

2026-10-24T14:14:39Z

🚨🇦🇪 Dubai Land Department data allegedly compromised, $100,000 demanded

The "Reze" ransomware group claims to have breached the Dubai Land Department, the government authority responsible for property registration and real estate regulation in Dubai.

The actor is advertising records involving 3,271 property owners, 32,211 tenants, and 43,986 properties, with approximately 450,000 participants referenced.

Published samples include names, phone numbers, Emirates ID numbers, passport details, and property ownership information.

The data is being offered for $100,000. The alleged breach has not been independently confirmed.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 French Communist Party data allegedly leaked, ...

2026-10-24T14:00:33Z

🚨🇫🇷 French Communist Party data allegedly leaked, records on over 183,000 people offered for sale

The actor "ChimeraZ" is selling a 40 MB dataset allegedly obtained from the French Communist Party (PCF), a political party in France.

The files contain 194,641 entries covering 183,363 people, including 113,971 phone numbers and 77,076 email addresses. Names and residential addresses are also included.

A sample of 1,000 records has been released across multiple file-sharing services. The seller is accepting offers in Monero (XMR).

The source and authenticity of the records remain unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇯🇵 EPARK Relax & Esthe extortion escalates, another ...

2026-10-24T13:54:33Z

🚨🇯🇵 EPARK Relax & Esthe extortion escalates, another 400,000 records released

The actor "NullPointerException" has published a third batch of data allegedly stolen from EPARK Relax & Esthe, bringing the total number of exposed records to 700,000.

The latest release reportedly includes names, phone numbers, email addresses, medical conditions, and treatment information.

The actor also claims to have discovered multiple zero-day vulnerabilities that allow access to live systems and the modification of patient medical records.

Another 800,000 records are threatened for release on October 26, 2026, unless the company pays $0.05 per customer record.

These claims have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Google says Gmail and Photos data shared with AI Search may ...

2026-10-24T13:43:58Z

🚨 Google says Gmail and Photos data shared with AI Search may inform targeted ads

Google has updated its privacy policy to clarify that data users choose to share from Gmail, Google Drive and Google Photos with services such as Search or Gemini may be used to personalize content, including advertisements.
⠀
This does not apply by default. The change affects users who enable features such as Personal Intelligence and allow other Google services to access their emails, files or photos.
⠀
Google says advertisers do not receive users’ Gmail, Drive or Photos content or identifying information such as names and email addresses.

The company also says ads will not be personalized using sensitive categories including health, religion, race or sexual orientation.
⠀
Users can prevent this data from influencing ads by disconnecting apps from Personal Intelligence or disabling Personalized Recommendations in Search Services Personalization.

Source: https://www.theverge.com/tech/1017600/google-personal-intelligence-privacy-policy-ads-update?utm_source=chatgpt.com

👀🚨🇫🇷 La France Insoumise, 1.2 million campaign ...

2026-10-24T13:04:42Z

👀🚨🇫🇷 La France Insoumise, 1.2 million campaign records allegedly leaked

A 544 MB archive linked to La France Insoumise (LFI), a major left-wing political movement in France, has been released by the actor "ChimeraZ".

The files contain approximately 1.27 million entries, including 1.16 million unique records covering door-to-door canvassing, residential addresses, GPS coordinates, campaign activities, and event information.

The material also references 54,838 doors opened and 208 campaign workers involved in canvassing.

The authenticity of the data remains unconfirmed.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Nostr event nevent1qqsqce633aq06sznqqatxswxmu9fxauhtep7r8jdlr6udpdcy9m7weczyqmq9cayrv6fgmvpcqrleadwpk4wykvhknsykyr7stjk5zgvpkdczj3f0a5

2026-10-23T23:48:54Z

Added RF to the forums monitored on the threat feed.

🚨🇺🇸 CIA contractor arrested for allegedly leaking top ...

2026-10-23T23:29:02Z

🚨🇺🇸 CIA contractor arrested for allegedly leaking top secret information to romantic partner

Ian A. Brinksman, 42, of Washington, D.C., has been charged with unlawfully transmitting national defense information.
⠀
The Justice Department alleges Brinksman used his access as a CIA contractor to retrieve five classified intelligence reports outside the scope of his work.

Articles containing similar information were later published by his romantic partner, who operated an independent publication on Substack.
⠀
Several of the reports were marked Top Secret, and all five carried Top Secret or Sensitive Compartmented Information markings.

Investigators say Brinksman and the publisher exchanged more than 800 calls or attempted calls during 2026.
⠀
Brinksman held a Top Secret clearance with SCI access and worked as a systems integration developer. He faces up to 10 years in prison if convicted.

Affidavit: https://www.justice.gov/opa/media/1468496/dl?inline

Source: https://www.justice.gov/opa/pr/us-government-contractor-arrested-allegedly-leaking-national-defense-information

🚨🇺🇸 University Hospitals disconnects systems after ...

2026-10-23T22:46:59Z

🚨🇺🇸 University Hospitals disconnects systems after detecting unusual server activity

University Hospitals in Ohio disconnected systems from the internet after detecting unusual activity on October 22.
⠀
The precautionary shutdown has affected its public websites, MyChart patient portal and other digital services. Disruptions may continue for several days while the health system investigates with outside experts.
⠀
University Hospitals says patient care has not been affected.

Patients needing information about appointments or test results should contact their provider directly. The health system has not confirmed that the incident was a cyberattack or disclosed whether any data was accessed.

Sources: https://www.cleveland19.com/2026/10/23/university-hospitals-experiencing-digital-service-disruptions/

🚨🇫🇷 Orange internal project files allegedly leaked on a ...

2026-10-23T21:10:33Z

🚨🇫🇷 Orange internal project files allegedly leaked on a forum

The actor "0xRune" has shared what appears to be internal files linked to Orange, the French telecommunications company operating across Europe, Africa, and the Middle East.

The dataset reportedly contains 29,503 files across 3,940 directories, primarily Jira project exports and attachments.

The files include internal IT infrastructure documentation, system configurations, technical diagrams, software development records, incident reports, project budgets, and business planning documents.

Claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨🇫🇷 Quad9 to withdraw DNS services from France after ...

2026-10-23T20:58:39Z

🚨🇫🇷 Quad9 to withdraw DNS services from France after court ruling

Quad9 says it will stop serving users in France on November 24 after a French court ordered the nonprofit DNS provider to block domains accused of streaming pirated sports broadcasts.
⠀
The case was brought by sports broadcaster beIN, which argued that the domains infringed its audiovisual rights.

The court reduced Quad9’s potential penalty from €580,000 to €1,000 per day but upheld the blocking requirement.
⠀
Quad9 says it cannot reliably identify French users without collecting location data, while blocking the domains globally would apply French law to users in every country.

The organization has chosen to withdraw from France instead of altering its DNS responses. An appeal is pending.

Quad9 also faces around 20 additional French lawsuits seeking the blocking of hundreds of domains.

Source:
https://quad9.net/news/blog/au-revoir-france/

🚨🇺🇸 Railway says breach potentially exposed secrets in ...

2026-10-23T20:23:20Z

🚨🇺🇸 Railway says breach potentially exposed secrets in around 100,000 workspaces

Cloud development platform Railway says an attacker gained access to internal systems and potentially exposed encrypted environment variables belonging to up to 1.85% of its workspaces, or roughly 100,000.
⠀
Some variables were decrypted using compromised credentials. These may have contained API keys, database credentials, private registry credentials and other sensitive information.

Railway believes the attacker was searching for AI provider API keys to conduct model distillation attacks.
⠀
The attack occurred between October 20 and October 22. Railway temporarily stopped new builds and deployments while responding, although existing customer applications remained online.

Railway says individual user accounts were not accessed, but it has not ruled out possible access to source code while its investigation continues.
⠀
All customers who stored credentials on Railway before October 21 should rotate them and review connected services for suspicious activity.

Railway has also invalidated access tokens, rotated internal credentials and worked with providers including GitHub, GitLab, OpenAI, Anthropic and Stripe to revoke potentially exposed keys.

Source:
https://blog.railway.com/p/preliminary-report-october-security-incident

🚨🇺🇸 GoDaddy revokes hundreds of thousands of SSL ...

2026-10-23T20:13:49Z

🚨🇺🇸 GoDaddy revokes hundreds of thousands of SSL certificates after policy errors

GoDaddy has completed a mass revocation involving 403,643 SSL/TLS certificates issued under its GoDaddy and Starfield certificate chains.
⠀
The certificates contained policy information that did not match the company’s published Certificate Policy and Certification Practice Statement.

The discrepancies involved certificate policy identifiers and links referencing the certificate authority’s documented practices.
⠀
GoDaddy initially identified 404,607 affected certificates but later corrected the total to 403,643.

By October 22:

• 378,067 certificates had been revoked
• 25,576 had already expired
• No affected certificates remained valid
⠀
GoDaddy missed the original five-day revocation deadline while coordinating replacements with affected customers, including government, financial and healthcare organizations.

The incident was a compliance failure, not a confirmed security breach or private key compromise.

Customers still using an affected certificate may see browser security warnings or have their website become inaccessible until the replacement certificate is installed.

🚨 Ruby fixes three regex engine bugs linked to remote code ...

2026-10-23T19:33:19Z

🚨 Ruby fixes three regex engine bugs linked to remote code execution risks

Ruby has released versions 4.0.9, 3.4.12 and 3.3.13 to address three memory corruption bugs in its Onigmo regular expression engine.
⠀
The flaws involve a double free and two integer overflow conditions. GitLab found that specially crafted regex patterns could trigger the bugs and potentially allow remote code execution.

Four GitLab vulnerabilities rely on the underlying issues:

• CVE-2026-89078
• CVE-2026-93577
• CVE-2026-97229
• CVE-2026-110264
⠀
Applications are only exposed when they compile regular expressions from attacker-controlled input. Ruby warns that Regexp.timeout and pattern length limits do not reliably prevent exploitation.

Administrators should update to Ruby 4.0.9, 3.4.12 or 3.3.13 and avoid compiling untrusted regex patterns if an immediate upgrade is not possible.

A small number of Threat Feed alerts may have been missed over ...

2026-10-23T17:44:33Z

A small number of Threat Feed alerts may have been missed over the past 24 hours due to a regression introduced during yesterday’s prompt update.

The issue has been fixed, and I’m running a full 24-hour reconciliation across monitored forums to identify and restore anything that may have been missed.

Combo lists and stealer logs are excluded from the backfill. The recovery process is currently running and is expected to take a couple of hours.

New activity will continue to be captured normally while the reconciliation runs.

Apologies.

🚨🇺🇸 Quest Diagnostics confirms data breach involving ...

2026-10-23T17:00:02Z

🚨🇺🇸 Quest Diagnostics confirms data breach involving patient records

Quest Diagnostics says an unauthorized party accessed its Quanum Lab Services Manager, a platform used by some healthcare clients to order laboratory tests and receive or review results.
⠀
The company discovered the intrusion on October 21 and believes certain patient records were accessed.

The number of affected patients and the types of information exposed have not yet been determined.
⠀
Quest suspended access to the affected system, notified federal law enforcement and brought in external cybersecurity experts to investigate.

The company said the incident has not materially disrupted its operations and is unrelated to the recently disclosed PHP vulnerabilities.

Source:
https://www.bleepingcomputer.com/news/security/quest-diagnostics-confirms-data-breach-exposed-patient-records/

🚨🇮🇩 Initial Access: Indonesian City Government A threat ...

2026-10-23T16:54:19Z

🚨🇮🇩 Initial Access: Indonesian City Government

A threat actor is advertising access to an unnamed city government in Indonesia reportedly generating more than $75M in revenue.

The advertised access includes Fortinet SSL-VPN and cPanel access, with WordPress management and phpMyAdmin reportedly accessible.

The access is listed for $300.

This claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Corium TRON wallet drainer source code advertised for $2,000 ...

2026-10-23T16:33:48Z

🚨 Corium TRON wallet drainer source code advertised for $2,000 on a hacking forum

The actor "f15" is selling what they describe as the source code for Corium Tron Drainer, a tool designed to steal TRX and TRON-based USDT from cryptocurrency wallets.

The listing claims support for Trust Wallet, TronLink, OKX Wallet, and other mobile and desktop wallets.

Features include automatic gas top-ups for wallets with insufficient TRX, deceptive transaction prompts, QR-code support, anti-detection measures, and a Telegram-connected admin panel.

The tool's advertised capabilities have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Aesthetic infostealer source code shared on a forum The ...

2026-10-23T16:28:14Z

🚨 Aesthetic infostealer source code shared on a forum

The actor "procurator" has shared what is described as the source code for Aesthetic, a Windows infostealer with remote access capabilities, a web-based control panel, and a built-in payload builder.

The malware reportedly targets Chromium and Firefox browsers, cryptocurrency wallets, messaging apps, gaming accounts, and developer tools. It also claims support for bypassing Chrome's App-Bound Encryption.

Aesthetic includes persistent remote access, screen and webcam monitoring, keylogging, file management, and remote command execution. Its control panel is built using Flask and SQLite, with subscription-based access.

The source code and advertised capabilities have not been independently verified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

🚨 Critical Okta Access Gateway flaw allows administrators to ...

2026-10-23T16:16:41Z

🚨 Critical Okta Access Gateway flaw allows administrators to execute system commands; CVE-2026-115547

The vulnerability affects the Okta Access Gateway Admin Console and carries a CVSS score of 9.1.
⠀
An authenticated administrator can submit specially formatted configuration values to execute commands within the context of the OAG service account.

Key details:

• Network exploitable
• Low attack complexity
• Administrative access required
• No user interaction required
• Affects OAG versions before 2026.10.2
⠀
Okta has resolved the vulnerability in Access Gateway 2026.10.2. Administrators should manually upgrade affected appliances.

Source:
https://trust.okta.com/security-advisories/command-execution-via-admin-console-input-in-okta-access-gateway-cve-2026-115547

🚨 PHP warns of another unpatched remote code execution risk; ...

2026-10-23T15:47:42Z

🚨 PHP warns of another unpatched remote code execution risk; CVE-2026-115560

The newly disclosed vulnerability is separate from the two PHP2Shell flaws patched earlier this week and is not fixed by PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
⠀
PHP says exploitation requires an unusual configuration where an application:

• Uses php_binary or php_serialize as its session serializer
• Changes the serializer to php at runtime before session_start()
• Has session upload progress enabled
⠀
PHP considers the risk unlikely and plans to release a fix during its next regular update cycle.

Until then, administrators with affected configurations should set:

session.upload_progress.enabled=0

Applications that do not change the session serializer at runtime are not exposed through this path.

No exploitation has been reported.

Source:
https://www.php.net/

🚨 Palo Alto Networks warns PAN-OS is affected by PHP2Shell ...

2026-10-23T15:30:44Z

🚨 Palo Alto Networks warns PAN-OS is affected by PHP2Shell remote code execution flaws

CVE-2026-109618 and CVE-2026-109619 affect the PAN-OS management web interface, including the HTTPS interface and XML API service.
⠀
Affected products include:

• PAN-OS 10.2, 11.1, 11.2, 12.1 and 12.2 release trains
• All Panorama versions
• All WildFire WF-500 and WF-500-B appliances
⠀
No special configuration is required, but the risk is highest when the management interface is exposed to the internet.

Palo Alto Networks rates the product impact at CVSS 8.7. PAN-OS hotfixes are expected between October 26 and 30, while dates for Panorama and WildFire appliance fixes remain unconfirmed.

The company is not aware of malicious exploitation targeting its products.

GlobalProtect and Captive Portal are not affected.

Source:
https://security.paloaltonetworks.com/CVE-2026-109618

⚠️ The forum Patched has released a statement a month after ...

2026-10-23T14:55:23Z

⚠️ The forum Patched has released a statement a month after going down, attributing the outage to a Russian drone strike that damaged its hosting infrastructure in Ukraine, with recovery efforts still ongoing and no confirmed date for its return. The administrators also revealed that a backup configuration error left their latest cloud database backup roughly a year old, further complicating recovery efforts.

Sure they weren't graded... and sure they weren't those ...

2026-10-23T00:48:54Z

Sure they weren't graded... and sure they weren't those PSA graded Pokemon cards that were stolen last week. 🤔

Dread: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/e3029f5b10828d702eba

This is pretty cool, ngl did not know this was a thing. Someone ...

2026-10-22T23:29:16Z

This is pretty cool, ngl did not know this was a thing. Someone on Dread is looking to commission realistic replicas of pills and other drugs to display as artwork, with no actual drugs involved.

An example I found: monartofficial.com

🚨🇺🇸 South Carolina man charged with distributing and ...

2026-10-22T23:07:20Z

🚨🇺🇸 South Carolina man charged with distributing and possessing child sexual abuse material

Daniel Aaron Todd, 23, of Ridgeville, was arrested on October 13 after a CyberTipline report from the National Center for Missing & Exploited Children led investigators to him.
⠀
Authorities said files containing child sexual abuse material were discovered during a search of his residence.

Todd faces one count of second-degree sexual exploitation of a minor and one count of third-degree sexual exploitation of a minor. Each felony charge is punishable by up to 10 years in prison.
⠀
The Dorchester County Sheriff’s Office and South Carolina Internet Crimes Against Children Task Force investigated the case.

Source:
https://www.scag.gov/about-the-office/news/dorchester-county-man-arrested-on-child-sexual-abuse-material-charges-2/

🚨 Initial Access: LATAM Manufacturing Company A threat actor ...

2026-10-22T22:57:48Z

🚨 Initial Access: LATAM Manufacturing Company

A threat actor is advertising SSL-VPN access to an unnamed manufacturing company in Latin America.

The actor claims the company has global partners, including major technology companies, and large investors, suggesting potentially high revenue.

The access reportedly has not been explored further to avoid alerting the target.

This claim is currently unverified.

💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing

Buy a seedbox if you're going to torrent. ...

2026-10-22T22:44:45Z

Buy a seedbox if you're going to torrent.

https://seedboxgui.de/

Ready for my YouTube year in review Ready for my Spotify year in ...

2026-10-22T21:04:45Z

Ready for my YouTube year in review

Ready for my Spotify year in review

Ready for my Netflix year in review

Ready for my Instagram year in review

Ready for my TikTok year in review

Ready for my X year in review

Ready for my Reddit year in review

Ready for my Discord year in review

Ready for my Twitch year in review

Ready for my Steam year in review

Ready for my PlayStation year in review

Ready for my Xbox year in review

Ready for my Nintendo year in review

Ready for my Amazon year in review

Ready for my Google year in review

Ready for my Apple year in review

Ready for my Microsoft year in review

Ready for my Snapchat year in review

Ready for my Facebook year in review

Ready for my LinkedIn year in review

Ready for my Uber year in review

Ready for my DoorDash year in review

Ready for my Airbnb year in review

Ready for my PayPal year in review

Ready for my Venmo year in review

Ready for my Duolingo year in review

Ready for my ChatGPT year in review

Ready for my GitHub year in review

Ready for my Cloudflare year in review

Ready for my Wikipedia year in review

Ready for my FBI watchlist year in review 😬

Ready for my therapist's year in review

🚨 Oracle patches critical unauthenticated Java vulnerability; ...

2026-10-22T20:46:29Z

🚨 Oracle patches critical unauthenticated Java vulnerability; CVE-2026-91403

A critical vulnerability in the Java Secure Socket Extension component affects Oracle Java SE and multiple GraalVM releases.

The flaw carries a CVSS score of 9.1 and can be exploited remotely without credentials or user interaction.
⠀
Successful exploitation could allow attackers to access, create, delete or modify critical data available to the affected Java or GraalVM deployment.

Affected products include:

• Oracle Java SE 8, 11, 17, 21, 25 and 27 releases listed by Oracle
• Oracle GraalVM for JDK 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20
⠀
Oracle released a security patch on October 21 and recommends applying the available updates.

Source:
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html