Website: https://darkwebinformer.com Website Pricing (Crypto payments are fully automated): https://darkwebinformer.com/pricing Socials: https://darkwebinformer.com/socials API Access: https://darkwebinformer.com/api-details About Dark Web Informer: https://darkwebinformer.com/about-dark-web-informer X: https://x.com/DarkWebInformer Updated: 2026-07-20
Small update on the dedicated D*xxing intelligence feed/tracker for enterprise, government, and law enforcement use.
The system automatically monitors d*xxing activity, tracks newly published posts, and is being expanded with source-page evidence capture and detailed incident intelligence.
Again... access will be restricted to authorized personnel only. No frontend to share yet, but the backend is getting close to where it needs to be.
Added 370 incidents to the Physical Bitcoin Attacks page. Data now goes all the way back to 2014.
The OpSec Manual created by Pitch user Mikoyan Gurevich
Dark Web: http://jqibjqqagao3peozxfs53tr6aecoyvctumfsc2xqniu4xgcrksal2iqd[.]onion
Credit on Pitch: https://pitchprash4aqilfr7sbmuwve3pnkpylqwxjbj2q5o4szcfeea6d27yd[.]onion/@mikoyan_gurevich
CVE-2024-21413: MonikerLink Outlook Vulnerability PoC
PoC: https://github.com/xaitax/CVE-2024-21413-Microsoft-Outlook-Remote-Code-Execution-Vulnerability
🚨 TeamViewer flaw lets remote hosts attack the computers controlling them
CVE-2026-111585 allows a malicious or compromised host to crash the TeamViewer client used to control it and, depending on the viewer’s operating system, potentially execute arbitrary code.
The vulnerability is triggered after a user establishes a remote-control session. A manipulated screen-size value causes an integer overflow, resulting in memory being written outside its allocated buffer. ⠀ • CVSS: 8.8 • Affected: TeamViewer Full Client on Windows, macOS and Linux, Windows Portable and Android Remote Control before 15.83 • Fixed: TeamViewer 15.83 or later • Exploited: No known attacks
Researchers demonstrated code execution against a Windows viewer, although the proof required part of the attack data to be supplied locally and was not a fully remote exploit.
TeamViewer has provided no workaround. Users should update immediately.
Source: https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1011/
🚨🇺🇸 Florida financial aid breach potentially exposes data of 4.9 million people
The Florida Department of Education says an unauthorized party accessed the Florida Student Financial Aid website, potentially exposing information belonging to people who previously applied for aid.
Exposed data may include:
• Social Security numbers • Names and dates of birth • Home and email addresses • Phone numbers • Gender identification codes ⠀ Officials discovered the breach on October 19 and took the website offline. The incident has been contained, but the department has not identified the attackers or explained how access was obtained.
Current financial aid, tuition payments and eligibility for scholarships, grants or student loans are not affected.
Those potentially impacted should monitor their accounts and credit reports and consider placing a fraud alert or credit freeze.
Source: https://www.fldoe.org/databreach.stml
‼️ New Dark Web Informer Blog Post!
Title: Bangkok Post Breach Claim Includes 822,140 Member Accounts and 6.9 GB Infrastructure Dump
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
‼️ New Dark Web Informer Blog Post!
Title: Defy Club Data Leak Claim Exposes 23,149 User Accounts With 23K+ Phone Numbers and 9K+ Emails
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Hollywood: “I'm hacking into the mainframe!”
2026: “Claude, commit a felony.”
🚨 Malicious Claude Code extension exposed up to 5,000 Cursor users
A modified version of Anthropic.claude-code, version 2.1.313, was distributed through Cursor’s extension marketplace for approximately 11 hours on October 29.
The extension was not developed by Anthropic. It collected system information, added an attacker-controlled SSH key, installed persistence and attempted to establish a reverse SSH tunnel. ⠀ Cursor says the backdoor generally failed to provide remote access because enabling the local SSH service required administrator privileges. However, the extension could still send host details and leave malicious files, persistence scripts and the SSH key behind.
Cursor removed the package, temporarily shut down and rebuilt its marketplace, rotated keys and took the attacker’s server offline.
Affected users must do more than uninstall the extension. Cursor recommends isolating impacted systems, removing the persistence mechanisms and SSH key, and rotating credentials from a trusted device.
Source: https://cursor.com/blog/claude-code-extension-security-notice
🚨🇸🇾🇺🇸 Syrian Electronic Army hacker “Th3Pr0” sentenced to 42 months in U.S. prison
Ahmad Umar Agha was sentenced for his role in cyber campaigns targeting approximately 47 Western media outlets, nonprofits and other organizations allied with the United States.
The Justice Department says the group collected intelligence for Bashar al-Assad’s government, disrupted reporting on the regime and targeted its opponents. ⠀ Agha was also connected to the compromise of a company hosting the U.S. Marine Corps recruitment website, which redirected visitors to propaganda urging service members to disobey orders.
He was added to the FBI’s Cyber Most Wanted list in 2016 and entered U.S. custody in 2025. Fellow Syrian Electronic Army member Firas Dardar remains a fugitive.
Source: https://therecord.media/syrian-electronic-army-hacker-sentenced-three-years
🚨🇫🇷 French Chess Federation data leaked, over 8,600 customer records exposed
An actor known as "ChimeraZ" has released a dataset linked to the French Chess Federation (FFE), the national governing body for chess in France.
The 3 MB CSV file contains 15,732 entries associated with 8,656 customers. Published samples include names, physical addresses, and transaction-related information.
The data has been distributed across multiple file-sharing platforms, although its origin and whether it resulted from a security breach remain unclear.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
10/30/2026, 1 engagement
🚨🇫🇷 Incognito customer information allegedly leaked, nearly 15,000 individuals affected
French online photo printing company Incognito has been named in a data release by the actor "ChimeraZ".
The 2 MB CSV dataset reportedly contains 21,353 entries associated with 14,996 individuals.
The files have been distributed across multiple download platforms.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇫🇷 French financial regulator AMF named in data leak, over 11,000 records released
The Autorité des Marchés Financiers (AMF), France's financial markets regulator, has been targeted in a data release by the actor "ChimeraZ".
The 49 MB dataset contains 11,173 records reportedly covering regulated financial entities, including company names, registration identifiers, legal structures, business addresses, regulatory authorizations, and investment management information.
The files have been published across multiple download platforms. It remains unclear whether the records originated from a breach or publicly accessible regulatory information.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
10/30/2026, 2 engagements
🚨🇫🇷 MySexShop customer data leaked, over 16,000 individuals potentially exposed
French adult platform MySexShop has been named in a data leak by the actor "ChimeraZ", who published a 6.4 MB dataset containing 22,968 entries associated with 16,338 individuals.
The files include user account information, email addresses, residential and delivery addresses, activity logs, and session records containing authentication tokens.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 New NetamLoader malware targets government Windows systems in Asia
Kaspersky uncovered a sophisticated .NET malware framework designed for a customized Windows 10 build used exclusively by Asian government organizations.
The infection chain uses legitimate Patch My PC components, Microsoft-signed assemblies and XAML payloads to bypass security scanning, hide inside dllhost.exe and download additional code. ⠀ Researchers found the malware inside a Windows update directory, raising suspicions of a supply chain attack. However, they could not confirm how it was delivered or whether the update infrastructure was compromised.
Only one infected system has been identified. The affected country was not disclosed, no data theft has been confirmed and the campaign has not been attributed to a known APT group.
Source: https://therecord.media/hackers-target-government-windows-systems-asia-new-malware
🚨🇫🇷 French political party Parti Radical de Gauche targeted in alleged data leak
A dataset linked to Parti Radical de Gauche (PRG), a French centre-left political party, has been released online by the actor "ChimeraZ".
The 400 KB archive reportedly contains 825 records covering 820 individuals, including names, email addresses, phone numbers, residential addresses, dates of birth, and professional information.
The files have been made publicly available through multiple download links.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 BTCPay Server 2.4.7 released, addressing 85 security findings, including 1 critical and 13 high-severity issues.
The update fixes vulnerabilities involving unauthorized invoice access, API permissions, two-factor authentication, payout manipulation, SSRF, and information disclosure.
Users are strongly encouraged to update, particularly those running versions 2.4.5 or earlier.
Source: https://github.com/btcpayserver/btcpayserver/releases/tag/v2.4.7
10/30/2026, 1 engagement
🚨🇺🇸 Initial Access: US Energy Company
A threat actor is advertising corporate SSL/VPN access to an unnamed U.S. energy company reportedly generating approximately $500M in revenue.
The company is described as having 500-1,000 employees. The actor states the target’s identity and additional technical details will only be disclosed to a buyer.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 Suspected hardware implant found inside Trezor Safe 5 wallet
Trezor is warning customers after receiving a credible report of an extra circuit board inside a Safe 5 purchased from former authorized reseller CryptoBilis through Tokopedia.
The suspected implant reportedly sits between the wallet’s main board and screen, allowing it to capture displayed information, including the recovery phrase, and transmit it over a mobile network when connected. ⠀ Trezor has not yet received or examined the device. No customer funds have been reported stolen, and four other CryptoBilis devices inspected by the company showed no signs of tampering.
Anyone who purchased any Trezor model supplied by CryptoBilis from March 2026 onward should:
• Move funds to a newly created wallet • Generate a completely new recovery phrase • Never restore the potentially exposed phrase on another device • Keep the original device and contact Trezor Support for a replacement
Source: https://trezor.io/blog/news/implant-reported-in-a-trezor-sold-by-cryptobilis
10/30/2026, 1 engagement
🚨 WordPress remote code execution flaw targeted hours after security update
Attackers began probing for a WordPress Core vulnerability shortly after version 7.1.4 was released on October 28.
The race condition temporarily exposes a predictable installation path while WordPress processes a full core update. An unauthenticated attacker who reaches the installer during this brief window could potentially execute code on the server. ⠀ Key details:
• CVE: None assigned • Official severity: Low • Third-party CVSS: Conflicting scores of 8.1 and 9.0 • Authentication required: No • Affected: WordPress 4.7 through 7.1.3 • Fixed: WordPress 7.1.4 and security releases for older branches ⠀ Wordfence reportedly recorded more than 18,500 requests targeting temporary installer paths during its first 21 hours of monitoring, with the first request detected nine minutes after it deployed a firewall rule.
The activity indicates active exploitation attempts, but does not establish that any websites were successfully compromised.
Administrators should update immediately and investigate suspicious PHP requests under wp-content/upgrade.
Source: https://cybersecuritynews.com/wordpress-rce-exploited/
🚨🇳🇴 Initial Access: Norwegian Real Estate Company
A threat actor is advertising SSH access to an unnamed Norwegian real estate company reportedly generating $1B-$5B in revenue.
The advertised access includes Database Admin privileges across an environment of approximately 5,000 hosts. McAfee ENS is reportedly deployed.
The access is listed for $706.
This claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 Steam RCE exploit allegedly offered for targeting high-profile individuals, $1,000 per slot
An actor using the handle "happyalisawq011" is recruiting individuals capable of socially engineering high-profile targets into running malicious Steam games allegedly designed to achieve remote code execution (RCE).
The actor is charging $1,000 per slot, with only one of five slots reportedly remaining. Access is being restricted to a small group of participants.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Movie Fact: In Hackers (1995), Matthew Lillard’s character, “Cereal Killer,” spends nearly the entire film without touching a computer. The only exception is a brief, one-second moment just before his famous “tension breaker” scene at Grand Central Station.
CZ says Binance will cover the losses.
10/29/2026, 3 engagements
Binance hacker can be tracked on Arkham. So far over $3 Billion stolen.
https://arkm.com/explorer/entity/21a94755-f604-45e5-9501-6542e23005e8
10/29/2026, 25 engagements
‼️ New Dark Web Informer Blog Post!
Title: Buenos Aires Student Database Leak Claim Lists 1.7 Million Enrollment Records
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
🚨 Critical Linux kernel TCP flaw enables remote root code execution; CVE-2026-98432
A race condition in the Linux kernel’s IPv4 TCP implementation can trigger a use-after-free before application authentication, potentially allowing an unauthenticated remote attacker to leak kernel memory, corrupt memory or crash the system.
Anthropic says Claude developed a working exploit that executed attacker-chosen commands as root against Linux servers with a Multipath TCP listener. The exploit took approximately 53 minutes to complete during testing and has not been publicly released. ⠀ • CVSS: 9.8 Critical, according to the Linux kernel CVE team • Affected: Linux kernels beginning with version 4.4 • Fixed: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56, 7.2.10 and 7.3 • Attack requirements: Network access, no credentials and no user interaction • Exploitation status: No known attacks in the wild ⠀ Ubuntu and Red Hat Enterprise Linux had not released corrected kernel packages as of October 29. Debian, Oracle Linux, Amazon Linux and SUSE have released fixes for at least some affected branches.
Distribution severity ratings differ substantially. Red Hat rates the flaw 5.9 because it considers the race difficult to win and describes denial of service as the most likely practical impact.
Source: https://lists.openwall.net/linux-cve-announce/2026/10/15/1
10/29/2026, 3 engagements
🚨🇩🇴 Edesur Dominicana customer data allegedly leaked, over 500,000 records exposed
Edesur Dominicana, an electricity distribution company in the Dominican Republic, has been named in a data leak by the actor "K3RN3L_P4N1C".
The dataset reportedly contains over 500,000 records, including customer names, national identification numbers, residential addresses, phone numbers, email addresses, account statuses, and outstanding electricity debts.
The actor has published a sample of approximately 1,000 records and is offering additional information through private messages.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 Zero-click “SMS of Death” flaw can crash Android phone services
A researcher has disclosed an unpatched Android vulnerability that allows a malformed WAP Push SMS to silently crash the com.android.phone process, dropping active calls and temporarily disabling cellular service without any interaction from the victim.
The message does not appear in the inbox, and carrier redelivery can repeatedly trigger the crash. The researcher also found that sending multiple messages rapidly could corrupt the SMS dataset, leaving telephony services crashing after every reboot. ⠀ • CVE: None assigned • Attack vector: Remote WAP Push SMS • User interaction: None • Impact: Denial of service, dropped calls and possible persistent loss of telephony • Tested: Pixel 9 and multiple Samsung Galaxy and A-series devices • Patch status: None available • Vendor status: “Won’t Fix” and classified as a non-security issue, according to the disclosure ⠀ The researcher reported the flaw to Google in May and publicly disclosed it on October 29 after the report and subsequent appeals were rejected.
There is currently no evidence that the vulnerability is being exploited in the wild.
Source: https://smsofdeath.com/
10/29/2026, 9 engagements
🚨🇨🇦 Hootsuite corporate account data allegedly exposed, 19,400 records offered for sale
An actor known as "webshell" is advertising a dataset containing 19,400 records allegedly obtained from Hootsuite, the Canadian social media management platform.
The records reportedly include user names, email addresses, corporate organization names, tenant IDs, account permissions, enabled features, and invoice history.
The seller is asking $15,000 for the dataset, which could expose organizations to targeted phishing, billing fraud, and account takeover attempts.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
10/29/2026, 1 engagement
Major Tor Browser update to v16.
https://blog.torproject.org/new-release-tor-browser-160/
Tor Browser 16.0 is a major stable update built on Firefox ESR 153, bringing current Firefox security fixes, redesigned settings, an updated built-in manual, improved Tor connection handling and additional anti-fingerprinting protections.
It also updates Tor to 0.4.9.14 and NoScript, while ending support for 32-bit x86 Linux and Android devices and Android versions older than 8.0.
10/29/2026, 2 engagements
🚨🇺🇸 Microsoft fixes Remote Desktop failures caused by recent Windows updates
Microsoft has resolved a Windows 11 issue that prevented non-administrator users from connecting to Remote Desktop hosts with Administrator protection enabled.
The problem appeared after installing the September 2026 preview update KB5124010 or later updates. Connection attempts could fail with error 0xC000000D and the message, “The token that was passed to the function is invalid.” ⠀ Affected systems include Windows 11 versions 24H2, 25H2, 26H1 and 26H2, primarily in enterprise environments using affected devices as Remote Desktop hosts.
The fix is included in the October 28 KB5127936 preview update and later releases. Administrators unable to install the update can temporarily disable Administrator protection through Microsoft Intune or Group Policy.
Sources: https://learn.microsoft.com/windows/release-health/status-windows-11-26H2
🚨 High-stakes poker players targeted with malware that exposed their cards
An attacker compromised the update systems of popular poker tools Jurojin and IntuitiveTables to distribute MeshAgent remote-access malware to selected users.
The malware allowed the attacker to view and control infected computers, potentially revealing players’ hole cards in real time. It activated only when usernames matched a hard-coded list of high-stakes targets, helping it remain undetected. ⠀ One professional player discovered the infection after a Claude AI agent noticed MeshAgent running in the background. He later identified 11 screen-capture events during poker sessions and estimated that he lost around $30,000.
Players and investigators estimate that the suspected cheater stole between $1.5 million and $4 million across major poker platforms. However, the individual accused by the poker community has not been charged with a crime. ⠀ Jurojin confirmed that tampered updates were selectively delivered between June 2025 and January 2026. CoinPoker and ClubWPT Gold banned suspected accounts and refunded affected players, while GGPoker introduced screen protection, anomaly detection and a ban on third-party poker tools.
10/29/2026, 2 engagements
🚨🇮🇳 Vijay Sales allegedly compromised, super administrator access and millions of records offered for sale
An actor using the handle "shinymontanna" is selling alleged super administrator access to the internal systems of Vijay Sales, a major Indian electronics retailer, for $25,000.
The listing claims access to over 3 million order records, information on 15,000 employees, and billing records for approximately 140,000 vendors.
The advertised access reportedly includes customer information, payment and bank transfer records, inventory, financial reports, and internal applications, with read, write, and export permissions.
Screenshots showing administrative dashboards and super administrator permissions have been published.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇧🇪 Belgian lawyers' registry data offered for sale, over 122,000 records exposed
An actor known as "RedStone" is selling data allegedly obtained from AVOCATS, the official registry covering Belgium's 26 French-speaking bar associations.
The advertised dataset contains 122,116 records, including information on approximately 10,600 lawyers, 43,548 unique email addresses, 17,174 phone numbers, and 53,452 addresses.
Beyond registry information, the actor claims to possess data from 13,585 member portal accounts, including private notification emails and partially masked mobile numbers. The seller also advertises persistent access to the registry through an active session.
A 1,000-record sample has been released, with the full dataset available to interested buyers.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
‼️ New ransomware leak site: Syntax
Dark Web: http://syntaxun5qjrkctaalxhrlibiczo7nke5latuukggyqte2oy5iwpn7qd[.]onion
🚨🇺🇸 Cisco firewall zero-day actively exploited to crash SSL VPN devices; CVE-2026-76418
Cisco has patched a high-severity vulnerability in Secure Firewall ASA and FTD software that allows an unauthenticated remote attacker to force affected devices to reload, causing a denial-of-service condition.
The flaw is triggered by a crafted request sent to the SSL VPN service when secondary authentication is configured on an affected tunnel group. A successful VPN login is not required. ⠀ • CVSS: 8.6 • Affected: Cisco Secure Firewall ASA and FTD with reachable SSL VPN services and secondary authentication • Fixed ASA: 9.16.4.104, 9.18.4.96, 9.20.4.50, 9.22.3.200, 9.23.1.48, 9.24.1.27 and 9.24.10.1 • Fixed FTD: 7.0.11, 7.2.13, 7.4.9, 7.6.7, 7.7.14, 10.0.3 and 10.1.1 ⠀ Cisco confirmed active exploitation in October but did not identify the attackers, targets or scale of the activity. No complete workaround is available, and administrators are urged to install a fixed release.
🚨 VirusTotal Enterprise account upgrades advertised for $800 using alleged administrator access
An actor known as "Zerrix" is offering to upgrade personal VirusTotal accounts to Enterprise using what they claim is access to a group administrator account.
The service reportedly unlocks file downloads, advanced search capabilities, a private API key, Retrohunt, and Livehunt.
The actor is charging $800 in cryptocurrency and claims the upgrades avoid the risks associated with leaked API keys or compromised accounts.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇫🇷 AGSI Computer allegedly breached, 5,000 customer and business records leaked
AGSI Computer, a French IT services company based in Saint-Ouen-l'Aumône, has been targeted by the actor "4me1", who has published a dataset allegedly obtained from the company's systems.
The files contain customer and business contact information, including names, company details, email addresses, phone numbers, and physical addresses. Sales leads, project inquiries, and internal customer management records are also included.
The actor dates the alleged breach to October 29, 2026, and has made the data available for download.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Telegram username going for $150,000.
Different Stages of OpSec:
Stage 1 - Blissful Ignorance: Believe Everything
Stage 2 - Growing Awareness: Question Everything
Stage 3 - Healthy Skepticism: Trust, but Verify
Stage 4 - Zero Trust: Never Trust, Always Verify
Stage 5 - Constant Vigilance: Trust No One, Verify Everything
Stage 6 - Total Paranoia: Assume Everything Is Compromised
10/28/2026, 8 engagements
🚨🇭🇳 Honduras Ministry of Foreign Affairs allegedly breached, over 40,000 records exposed
An actor using the handle "GordonFreeman" claims to have compromised the Honduran Ministry of Foreign Affairs through an exposed API, obtaining 40,127 records from its internal systems.
The 58.5 MB dataset reportedly contains names, email addresses, phone numbers, national identification numbers, residential information, and account password hashes.
The actor has published a 5,000-record sample and warned that this is the first in a planned series of cyberattacks targeting Honduran institutions.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇺🇸 Massive leak reportedly exposes more than 41,000 U.S. Homeland Security employees
A group calling itself the Department of Peace claims it compromised a Department of Homeland Security system and obtained records belonging to employees across ICE, CBP, CISA and several other DHS agencies.
The dataset reportedly contains names, work emails, cellphone numbers, job assignments and facility locations. It also exposes memberships in internal access groups associated with undercover and covert operations, wiretap programs, Palantir software, Cellebrite tools and xAI’s Grok chatbot. ⠀ Journalists who reviewed the material found records connected to undercover ICE personnel and other sensitive law enforcement roles. The data has since been released publicly with a searchable interface.
The group reportedly gained access using a compromised Okta single sign-on account. DHS, ICE and CBP had not publicly confirmed the breach or responded to requests for comment at the time of publication.
🚨 DarkForums rolls out major update featuring redesigned interface and security improvements
DarkForums administrator "knox" has announced a platform-wide update introducing a new Emerald Dark theme, improved navigation, performance optimizations, and numerous bug fixes.
The update also includes additional security enhancements and a dedicated changelog where members can track new features, improvements, and resolved issues.
Further updates and optimizations are planned as development continues.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
10/28/2026, 1 engagement
darkforums[.]team is a phishing site. The real DF clearnet and onion are still down.
🚨 WordPress 7.1.4 released with fixes for 22 security vulnerabilities
WordPress has released version 7.1.4 and is urging administrators to update their websites immediately. ⠀ The security release addresses a race condition in the core upgrade process that could lead to remote code execution during the upgrade window.
It also fixes multiple stored cross-site scripting vulnerabilities affecting block markup, privacy data removal requests, the Interactivity API, Customizer selective refresh, Categories, playlists, images, comment pagination and specially crafted usernames. ⠀ Other resolved issues include:
• Disclosure of unpublished Customizer changes to unauthenticated visitors • A stored denial-of-service issue in the Interactivity API • Improper access to Notes attached to posts • Several security-hardening weaknesses • Replacement of bundled root certificates following the eMudhra revocation ⠀ Many of the vulnerabilities require Contributor, Author or Editor-level access, but the exact requirements vary by issue.
Security fixes have also been released for affected branches from WordPress 7.0 through 4.7. Versions 4.6 and earlier no longer receive security updates. ⠀ WordPress has not indicated that any of the vulnerabilities are being actively exploited.
Administrators can install the update through Dashboard > Updates. Sites with automatic background updates enabled should begin updating automatically.
Source: https://wordpress.org/news/2026/10/wordpress-7-1-4/
T1 is back up on the feed, I'm running a 5 day catchup so it will get those claims that were missed. It may catch some very old threads, but this is just a one time thing.
🚨🇺🇸 Discord will let search engines index messages from public servers
Starting in mid-December, messages posted in eligible public channels on Discoverable Discord servers may appear on server web pages and in search results on Google and other search engines. ⠀ The change only applies to Discoverable Servers, which have at least 1,000 members and can be joined without an invitation.
Private servers, restricted channels, direct messages and group DMs are excluded. ⠀ Discord says:
• Messages posted before the rollout will not be included • Usernames and avatars will not appear beside indexed messages • Participating channels will be clearly labeled • Server administrators can exclude individual channels or disable the feature • Users can prevent future messages from appearing through Data & Privacy settings • Teen accounts are excluded entirely ⠀ The individual message setting will be enabled by default in most regions. It will be disabled by default in the EU/EEA, UK, Canada, Brazil, Australia and South Korea.
Turning the setting off only affects messages posted while it is disabled. Messages sent while the feature was enabled may remain public unless the original Discord message is deleted, and cached search results may take longer to disappear. ⠀ Beginning November 16, every Discoverable Server will also receive a public Server Web Page that may contain AI-generated summaries of discussions from selected public channels.
Source: https://discord.com/blog/making-content-from-discoverable-servers-easier-to-discover
10/28/2026, 1 engagement
🚨🇦🇪 Telegram zero-day can enable code execution through malicious animated content
A vulnerability in Telegram’s rlottie animation library can allow attackers to execute arbitrary code within the application process.
Tracked as CVE-2026-111105, the flaw carries a CVSS score of 7.0 and was publicly disclosed by Trend Micro’s Zero Day Initiative after remaining unresolved at the client-code level. ⠀ The vulnerability is caused by improper validation of attacker-controlled animation data, resulting in a write before the beginning of an allocated memory buffer. ⠀ Despite reports describing the flaw as a zero-click sticker attack, ZDI’s final advisory says user interaction is required. The victim must visit a malicious page or open a malicious file for exploitation to occur. ⠀ Telegram told ZDI that server-side sticker validation mitigates the vulnerability. However, ZDI continued seeking a client-side fix and ultimately published the issue as a zero-day advisory on October 15. ⠀ No affected client versions, patched versions or confirmed in-the-wild attacks have been disclosed.
Users should keep Telegram updated and avoid opening untrusted animated files, sticker packs or external links until a client-side fix is confirmed.
Source: https://www.zerodayinitiative.com/advisories/ZDI-26-757/
🚨🇺🇸 Seminole County Schools takes systems offline after cyber incident
Seminole County School System in Georgia detected unusual activity within its IT environment on October 19 and took affected systems offline as a precaution.
The district brought in outside cybersecurity specialists to investigate and restore services. It has not confirmed whether information was accessed, stolen or encrypted. ⠀ Global Secret Group has claimed responsibility and says it released 39.6 GB of data containing 54,468 files.
However, the group’s leak-site listing incorrectly combines information from three different school districts. It names a Florida location and links to an Oklahoma school website, while the posted sample documents identify Georgia’s Seminole County School System. ⠀ The samples reportedly contain accounts using the district’s seminole.k12.ga.us domain and a Georgia audit agreement naming district officials.
The district has not attributed the incident to Global Secret Group or confirmed the authenticity of the leaked data.
Source: https://dysruptionhub.com/seminole-georgia-schools-cyber-incident/
🚨🇺🇸🇩🇪 Cruise missile and business jet engine blueprints advertised for sale
An actor using the handle "NobawkeyKostaq" is offering what they claim are detailed engineering blueprints for engines associated with the Tomahawk, JASSM, and Taurus cruise missiles, alongside F133/F144 business jet engines.
The advertised files reportedly include CAD models, technical drawings, internal component designs, material specifications, and assembly documentation in STEP, IGES, DWG, and PDF formats.
The seller claims buyers will receive unrestricted access to the designs and has offered proof to interested parties.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 Actor seeks bulk suppliers of stolen credit card data, offering up to $8 per card
An actor using the handle "bobwell1" is recruiting long-term suppliers of credit card information, including card numbers, expiration dates, CVVs, and associated billing details.
The listing offers $8 for valid new U.S. and Canadian cards, $1–$2 for previously used cards, and $1 for valid cards from other countries.
The buyer prioritizes large, non-public datasets, rejects publicly resold information, and requires escrow transactions for new suppliers.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇺🇸 Hackers begin targeting critical Oracle E-Business Suite flaw
Threat actors are scanning for systems vulnerable to CVE-2026-101767, a critical unauthenticated SQL injection flaw in Oracle E-Business Suite that can be chained to remote code execution. ⠀ The vulnerability carries a CVSS score of 9.8 and affects E-Business Suite versions 12.2.3 through 12.2.15. ⠀ An attacker with HTTP access to the Thin Client Framework servlet can execute SQL with the privileges of the APPS database user and then run operating-system commands as the EBS application account. ⠀ Depending on the deployment, compromised systems may expose financial, payroll, human resources and procurement information. ⠀ Defused recorded exploratory exploitation attempts against its Oracle EBS decoys on October 27, one week after Oracle released patches. Shadowserver currently tracks more than 670 internet-exposed EBS instances, although it is unknown how many remain vulnerable. ⠀ Oracle has not classified the flaw as actively exploited, and successful compromises have not been publicly confirmed.
Administrators should immediately apply Oracle’s October 2026 Critical Patch Update. If patching is delayed, restrict the EBS web tier to trusted networks and remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.
Source: https://www.oracle.com/security-alerts/cpuoct2026.html
🚨🇺🇸 Critical 16-year-old EDK II flaw enables code execution before Secure Boot
A critical buffer overflow in TianoCore EDK II, the open-source foundation used to build much of the world’s UEFI firmware, can allow an unauthenticated attacker to run code before the operating system loads.
Tracked as CVE-2026-97631, the vulnerability carries a CVSS score of 9.5 and has existed in the code since November 2010. ⠀ The flaw resides in the PXE network-boot driver, which copies incoming ICMP error messages into a fixed 504-byte buffer without properly limiting their size. ⠀ An attacker who can reach a machine while it is booting over the network can send a crafted ICMP message that:
• Crashes the firmware and prevents the operating system from loading • Executes attacker-controlled code in the pre-boot environment • Runs before Secure Boot and measured-boot protections evaluate the operating system ⠀ Reliable code execution requires knowledge of the target’s firmware build. Systems that boot exclusively from local storage are not exposed through this attack path. ⠀ An upstream fix was merged into EDK II on October 15, but no stable EDK II release currently includes it. Server and motherboard vendors must integrate the patch and distribute BIOS or UEFI updates to customers.
Source: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
‼️ New Dark Web Informer Blog Post!
Title: Capiter Data Leak Claim Exposes 208,206 User Accounts and Phone Numbers
Link: https://darkwebinformer.com/capiter-data-leak-claim-exposes-208-206-user-accounts-and-phone-numbers/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
‼️ New Dark Web Informer Blog Post!
Title: INBI School of English WhatsApp Data Claim Includes 3.34 Million Messages and 171,967 Phone Numbers
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
🚨🇺🇸 Critical GoAhead flaw allows revoked certificates to bypass authentication
A critical vulnerability in the GoAhead embedded web server causes revoked client certificates to remain valid on certain mutual TLS deployments.
Tracked as CVE-2026-115881, the flaw carries a CVSS score of 9.1 and affects GoAhead versions 3.4.5 through 6.1.0. ⠀ GoAhead loads the configured certificate revocation list but fails to enable the OpenSSL flag that actually enforces it. An attacker possessing a previously trusted certificate and its private key could continue accessing protected services after the certificate was revoked. ⠀ Researchers also disclosed two related TLS flaws:
• CVE-2026-115884: Certain LibreSSL builds may accept an overlong certificate chain, CVSS 7.4 • GOAHEAD-SA-2026-0005: Mbed TLS builds may use a one-byte Diffie-Hellman modulus, allowing some recorded TLS 1.2 sessions to be decrypted, CVSS 5.9 ⠀ GoAhead is embedded in management interfaces for routers, printers, gateways and industrial equipment.
Exposure depends on the TLS library and configuration used by each device, so the widespread use of GoAhead does not mean every device is vulnerable. ⠀ All three flaws were fixed in GoAhead 6.1.1. Device owners may need to wait for firmware containing the update from their equipment manufacturer.
Source: https://github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5
🚨🇫🇷 French IT company allegedly compromised, Stripe and Vercel API keys offered for sale
An actor using the handle "libreboot2016" is selling access to sensitive API keys allegedly belonging to an unidentified French IT services and professional training company based in Haguenau, with €1.6 million in annual revenue.
The credentials reportedly provide access to Vercel, Stripe, Pennylane, Wedof, Resend, and Supabase, potentially exposing customer information, payment records, invoices, internal databases, and authentication systems.
The actor claims access to payment details for approximately 1,800 customers, along with thousands of financial documents and CRM records. The credentials are being offered for $200.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇸🇬 PatSnap allegedly breached, over 270,000 contact records offered for sale
PatSnap, a Singapore-based intellectual property and innovation intelligence company, has been named in a data leak by the actor "JSON09".
The actor is selling a dataset containing 270,652 records for $200, reportedly obtained on October 27, 2026. The information includes names, job titles, professional roles, email addresses, phone numbers, and mailing addresses.
A sample has been published alongside the listing.
Claim is currently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇺🇸 Veeam patches critical Backup & Replication authorization bypass
Veeam has released security updates addressing five vulnerabilities across Backup & Replication, Veeam Agent for Linux and Veeam ONE. ⠀ The most serious, CVE-2026-108142, carries a CVSS score of 9.1 and allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. ⠀ Other patched vulnerabilities include:
• CVE-2026-105477: Local privilege escalation in managed Veeam Agent for Linux installations, CVSS 7.3 • CVE-2026-108140: Arbitrary file writes through path traversal, CVSS 5.9 • CVE-2026-108141: Arbitrary file writes through path traversal, CVSS 5.9 • CVE-2026-107671: Veeam ONE administrator can bypass MFA by disabling it before completing verification, CVSS 8.5 ⠀ Backup & Replication versions 13.0 and 13.1 are affected by the authorization and path-traversal flaws.
Older 12.x releases are not affected by those specific issues. ⠀ Administrators should update to:
• Backup & Replication 13.1.2 build 13.1.2.57 • Backup & Replication 13.0.3 build 13.0.3.63 • Veeam Agent for Linux 13.1.2 build 13.1.2.11 • Veeam ONE 13.1 P1 build 13.1.0.7940
Sources: https://www.veeam.com/kb4948, https://www.veeam.com/kb4951
🚨🇨🇭 Nearly 100,000 Swiss medical professional records advertised in MedReg data leak
A dataset containing 99,201 records linked to MedReg, Switzerland's national register of medical professionals, has been advertised by the actor "92cityuhq".
The 98 MB archive reportedly contains names, birth years, genders, nationalities, professional qualifications, medical specialties, licensing information, and practice authorization details.
Sample records have been published, with the full dataset offered for download. Unknown if the information was obtained through a security breach or collected from publicly accessible registry records.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇱🇰 Barista Sri Lanka allegedly breached through PHP vulnerabilities, customer information exposed
Barista, one of Sri Lanka's largest café chains with more than 100 outlets, has been targeted by an actor using the handle "secret_solder".
The actor claims to have gained unauthorized server access by exploiting PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, allegedly achieving remote code execution without authentication.
According to the post, the server was running an outdated PHP 8.1.34 installation with exposed configuration details.
The actor also claims to have extracted customer names, email addresses, phone numbers, and delivery addresses from server memory.
A sample containing customer names and phone numbers was published. The intrusion and vulnerability claims remain independently unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
⚠️ Disclaimer: This video explores disturbing allegations, unsettling online behavior, and sensitive subject matter involving minors.
smartschoolboy9: An Internet Rabbit Hole
In April 2024, a Reddit user uncovered a disturbing collection of Instagram accounts that appeared to be operated by children. But a closer look at their unsettling content raised serious questions about who was really behind them and what was happening out of sight.
What followed was a descent into one of the internet’s most bizarre and disturbing mysteries: smartschoolboy9, a rabbit hole that continues to raise questions to this day.
Video Credit: youtube.com/@NickCrowley
10/27/2026, 1 engagement
‼️ New Dark Web Informer Blog Post!
Title: Daily Dose of Dark Web Informer - October 27, 2026
Link: https://darkwebinformer.com/daily-dose-of-dark-web-informer-october-27-2026/
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
🚨🇺🇸 Hackers target Federal Election Commission, forcing filing system offline
The U.S. Federal Election Commission temporarily shut down its electronic filing system after hacking attempts disrupted the service one week before the November 3 midterm elections. ⠀ The outage prevents political committees and other organizations from submitting mandatory 24-hour and 48-hour spending reports, reducing the amount of current campaign-finance information available to the public. ⠀ The system has reportedly been offline since around 10 p.m. ET on October 26. FEC staff are working to restore the service, while previously filed reports remain searchable on the agency’s website. ⠀ There is currently no confirmation that the attackers gained access, stole data or altered any filings. The identity and motive of those responsible also remain unknown. ⠀ The FEC tracks campaign spending but does not administer elections. The incident should not affect voter registration, ballot systems or the public’s ability to vote.
10/27/2026, 3 engagements
🚨🇫🇷 ACF Assurances customer data allegedly leaked, 23,000 records advertised
A French insurance brokerage firm, ACF Assurances, has been named in a data leak by the actor "Alduin", who claims to have obtained policyholder information.
The 6.8 MB dataset reportedly contains customer names, email addresses, mobile numbers, dates of birth, residential addresses, postal codes, and cities.
Sample records have been published, exposing personal and contact information. The source and authenticity of the data have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
"Speedstepper" has been added to the OpSec Failures page.
Direct file: https://darkwebinformer.com/opsec-failures/#file-speedstepper
🚨🇺🇸 Connecticut man accused of using the dark web to download and share child sexual abuse material
Jared James, 31, of Hartford, has been arrested after police allegedly found more than 2,000 child sexual abuse images and videos on electronic devices inside his apartment.
Hartford police say investigators determined that James used the dark web to download and share videos depicting child sexual abuse.
Detectives from the department’s Child Exploitation Prevention Unit executed a search warrant at his Capitol Avenue apartment on October 23 and seized several electronic devices.
James was charged with first-degree possession of child sexual abuse material and held on a $500,000 bond.
Source: https://patch.com/connecticut/hartford/hartford-man-accused-having-2-000-images-child-porn-police
🚨🇬🇧 UK lawmaker Jess Asato takes xAI to court over sexualized Grok deepfakes
Labour MP Jess Asato is suing Elon Musk’s xAI after Grok users generated and shared non-consensual sexualized images and videos depicting her. ⠀ The content appeared after Asato publicly criticized Grok for being used to create sexualized deepfakes of women and children. It included fabricated bikini images and a disturbing video depicting her being prepared for a sexual assault. ⠀ Asato said she repeatedly reported the material to X but was initially told it did not violate the platform’s rules. The content was removed after her lawyer contacted the company. ⠀ Her High Court claim alleges breaches of UK data-protection law and misuse of private information, arguing that xAI processed her face and likeness without consent. ⠀ Asato is also seeking an order preventing Grok from generating further non-consensual sexualized images of her. The case could help establish how AI companies are held responsible when their tools are used to create abusive deepfakes.
Source: https://www.wired.com/story/the-big-interview-podcast-jess-asato/
🚨🇺🇸 Microsoft Authenticator flaw allowed malicious Android apps to steal work account tokens
Tracked as CVE-2026-80097, the high-severity vulnerability allowed an Android app with no permissions to impersonate trusted Microsoft apps such as Teams and request tokens for a work account signed into Authenticator. ⠀ Researchers demonstrated that the stolen tokens could provide access to:
• Email and the ability to send messages • Files stored in Microsoft services • Calendars and Teams chats • Authentication methods and passkey management ⠀ The flaw existed because Authenticator trusted identity information supplied by the requesting app instead of confirming which app actually made the request. ⠀ Microsoft rates the vulnerability 8.6 and says exploitation requires a malicious app on the device and user interaction during authentication. However, researchers reported obtaining tokens without further interaction when a work account was already signed in. ⠀ Microsoft says it has found no evidence of exploitation. The issue affects Authenticator for Android versions before 6.2606.4246.
Users should update to version 6.2606.4246 or later.
Source: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80097
🚨🇭🇰 Keystone to destroy 18,835 hardware wallets after authentication key theft
Keystone says an attacker breached its website and stole the cryptographic key used to verify that its hardware wallets are genuine. ⠀ The stolen key could allow counterfeit wallets to pass Keystone’s official authenticity check, potentially exposing users to cryptocurrency theft. The key cannot be replaced on devices that have already been manufactured, forcing the company to destroy 18,835 unsold wallets and suspend pending shipments. ⠀ The attacker exploited a vulnerability in a third-party data monitoring tool and also accessed 25,964 buyer records containing names, contact details, shipping addresses and order information. ⠀ Another 12,873 unpaid checkout records were potentially exposed. Some customer data should have already been erased under Keystone’s 180-day retention policy, but an automated deletion tool had failed. ⠀ Keystone says recovery phrases, private keys and payment information were not compromised.
Customers who received a device using the old authentication key after October 20 should contact Keystone for additional verification. The company is not recalling devices and warns that anyone asking customers to return a wallet may be attempting a phishing scam.
🚨🇫🇷 ENGIE confirms customer data stolen from partner marketing platform
French energy giant ENGIE says attackers gained access to a platform used by business partners for customer prospecting and marketing energy offers. ⠀ The exposed information includes:
• Names • Mailing addresses • Email addresses • Phone numbers • Customer IDs • Contract numbers • Electricity delivery or gas metering point references ⠀ ENGIE says no banking information was affected and its internal IT systems were not compromised. The company blocked the unauthorized access, notified authorities and contacted affected customers in France. ⠀ The number of affected customers and the identity of the compromised platform have not been disclosed.
No ransomware or extortion group has publicly claimed responsibility as of this post.
🚨🇺🇸 CISA confirms critical PHP2Shell flaws are now being exploited in attacks
CISA has added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog after confirming active exploitation. ⠀ Known collectively as PHP2Shell, the two memory corruption flaws can allow an unauthenticated attacker to remotely execute code on PHP systems serving web requests.
Affected configurations include PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The PHP team considers mod_php installations at the highest risk. ⠀ Both vulnerabilities have a CVSS 4.0 score of 9.2.
Fixed versions:
• PHP 8.5.12 • PHP 8.4.27 • PHP 8.3.36 • PHP 8.2.35 ⠀ CISA has ordered U.S. federal agencies to remediate the vulnerabilities by October 29.
The PHP team says there are no complete mitigations and that updating is the only safe solution.
10/27/2026, 1 engagement
🚨 Virtualine: An offshore hosting provider offering bulletproof hosting services has reportedly been seized by the FBI. There is no press release at this time.
🚨🇨🇳 Chinese defense technology firm Jingan Tech allegedly breached, source code and government project files exposed
Hangzhou Jingan Technology, a Chinese company specializing in advanced defense technology, infrastructure security, urban security, and national defense systems, has been named in a data leak.
The actor "Aku" claims to possess 2.85 GB of compressed data containing proprietary source code and files related to government projects.
The actor reportedly attempted to sell the information privately but decided to release a portion after negotiations with a potential buyer broke down.
The alleged breach dates to October 2026. The authenticity of the files and the extent of the compromise remain unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇩🇰 University of Copenhagen data breach exposes information belonging to 525,000 people
Hackers gained access to a university test environment containing full names, Danish national identity numbers, work and private telephone numbers, and personal email addresses. ⠀ PIN codes used with the ID cards of around 20,000 staff members and students were also compromised. The university replaced the affected codes and temporarily restricted access to selected critical locations. ⠀ The attack was detected on October 20 and has since been contained. The university says there is no indication that the hackers reached systems supporting daily operations or disrupted its activities. ⠀ The incident has been reported to the Danish Data Protection Agency and other relevant authorities. The university is still investigating the full scope of the breach.
Source: https://news.ku.dk/all_news/2026/10/university-of-copenhagen-hit-by-cyber-attack/
‼️🇺🇸 BYOD is doubling down on its claim against the University of New Mexico, stating that the stolen data is up for grabs and that the university can purchase its own data, along with the decryption key for its files.
CVE-2025-24071: Simply extracting a .rar archive containing a malicious .library-ms file can cause Windows Explorer to initiate an outbound SMB authentication request, potentially exposing the user's NTLM hash. No further interaction is required after extraction.
Exploit and Video Credit to @0x6rss:
10/26/2026, 1 engagement
👀🚨🇫🇷 Vulnerability allegedly exposes personal data of up to 15 million people in France
An actor using the handle "Vagrantly" is selling exclusive access to an unauthenticated API endpoint containing approximately 50 million identifiers.
The endpoint reportedly exposes names, phone numbers, email addresses, residential addresses, and, in some cases, vehicle license plates.
After testing over 100,000 identifiers, the actor claims roughly 33% returned personal information, suggesting as many as 15 million records could be accessible.
The endpoint is rate-limited, making large-scale extraction time-consuming. The actor is offering access to a single buyer rather than extracting the data themselves.
The vulnerability and potential exposure remain unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
‼️🇺🇸 University of New Mexico has been named by BYOD ransomware
The full post reads:
36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇫🇷 French Handisport Federation records shared online, approximately 5,000 entries advertised
The French Handisport Federation (FFH), which oversees sports for athletes with physical and sensory disabilities in France, has had information linked to its members and affiliated clubs shared online.
The actor "camillelelouche" published data described as scraped from the federation, including names, email addresses, phone numbers, dates of birth, sports affiliations, license information, and disability classifications.
Sample records have been provided, with the dataset offered for free. There is currently no confirmation of a breach of the federation's internal systems.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 TropiPay allegedly breached, customer credentials and financial identity records exposed
TropiPay, an online financial platform used to send, receive, and manage money, has been named in a data leak by the actor "Emzywemzy".
The actor claims the breach occurred on October 13, 2026, affecting 294,998 users.
The published listing references more than 1.1 million client records, 339,691 credential entries, 100,865 verification records, and 11,236 merchant records.
Exposed information reportedly includes names, email addresses, phone numbers, physical addresses, dates of birth, password data, and KYC verification details.
Samples containing email and password combinations have been displayed. The authenticity and extent of the breach remain unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 DreamHost forces email and FTP/SFTP password resets during ongoing incident
DreamHost has expired passwords for some email and FTP/SFTP users following an incident affecting its webmail and File Manager services. ⠀ The company says all impacted account owners have now been emailed instructions. Affected users will remain unable to access their email or files until the account owner creates new passwords and shares the credentials with them. ⠀ DreamHost has not disclosed the cause of the incident, whether any data was accessed or how many customers were affected.
Its browser-based File Manager also remains unavailable as restoration work continues. ⠀ Account owners should go directly to panel.dreamhost.com and reset credentials under:
• Mail > Manage Email • Websites > SFTP Users & Files
DreamHost warns that it will never request passwords by email or direct customers to sign in through an emailed link.
Sources: https://www.dreamhoststatus.com/
CNET is livestreaming on TikTok, repeatedly folding and unfolding the iPhone Duo.
CVE-2026-40369: An unprivileged arbitrary 12-byte kernel write primitive exists in nt!ExpGetProcessInformation and can be reached from any context capable of calling NtQuerySystemInformation, including sandboxed Chrome, Edge, and Firefox renderer processes.
PoC and Writeup 👇
PoC: https://github.com/orinimron123/CVE-2026-40369-EXPLOIT
Writeup and Video Credit: https://voidsec.com/cve-2026-40369-browser-sandbox-escape/
🚨 Medkey EHR is vulnerable to an IDOR that can expose other patients’ records; CVE-2026-12207
PoC: https://github.com/r0xkrnl/Medkey-EHR-IDOR-PoC
The flaw affects Medkey’s REST API and stems from insufficient authorization checks in the patient lookup functionality. An authenticated user can manipulate a patient ID value and retrieve records belonging to other patients.
CVSS: 4.3 Medium Impact: Unauthorized access to patient information Affected: Medkey rolling-release builds through commit fc09b7ba9441ff590b72d428d5380834216b09ed
The issue is tracked as CWE-99, Improper Control of Resource Identifiers, and can be exploited remotely with low privileges and no user interaction.
‼️🇨🇷 WhiteArmor claims access to Gamdom’s full user database and is demanding $15 million in Bitcoin.
🇨🇷 Gamdom - An online casino and sportsbook founded in 2016, offering crypto-based casino games, sports betting, and esports wagering.
The listing claims 15,420,003 user accounts across 146 database columns, with combined account profit values exceeding $1 billion.
WhiteArmor says access came through an internal machine account with administrative privileges and has published a sample of 100 accounts as proof.
The authenticity and the extent of the alleged compromise have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A user on Dread is promoting Dark Empire RPG, a browser-based multiplayer cyberpunk RPG built with PHP, HTML/CSS and Python. The game features a marketplace, crafting, guilds, territory wars and law-enforcement career paths.
Dread Announcement: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/bc7cbb5e64f166778e4c
Dark Web: http://kd67wsybyev4mxqbizgw2hizs76jezqgc5eea5b6k7ftccfc65qeibid[.]onion/
10/26/2026, 1 engagement
"Defcon" has been added to the OpSec Failures page.
Direct file: https://darkwebinformer.com/opsec-failures/#file-defcon
🚨 PHP releases new Windows builds to fix critical HTTP2Shell vulnerability
The PHP team has rebuilt its supported Windows packages with Brotli 1.2.1, addressing CVE-2026-111497, an out-of-bounds write flaw that can potentially lead to remote code execution. ⠀ In PHP’s Windows builds, the vulnerable Brotli decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled.
This cURL feature is disabled by default, but applications and HTTP client libraries can turn it on. ⠀ Updated builds:
• PHP 8.5.12-1 • PHP 8.4.27-1 • PHP 8.3.36-1 • PHP 8.2.35-1 ⠀ The “-1” suffix indicates that the Windows packages were rebuilt with updated dependencies. The PHP source and runtime version numbers remain unchanged.
This is separate from the PHP2Shell flaws patched on October 21.
Source: https://www.php.net/archive/2026.php
10/26/2026, 1 engagement
🚨 Crimeflare releases emergency WAF rules for critical Brotli vulnerability
Crimeflare has added two detection rules for CVE-2026-111497 to its Managed Ruleset, targeting Brotli-encoded request bodies and the Next.js image optimization endpoint. ⠀ The vulnerability is an out-of-bounds write in the Brotli decoder. Malformed compressed input can corrupt process memory, potentially causing crashes, memory disclosure or remote code execution.
It affects software that uses vulnerable Brotli versions, including supported Node.js 22.x, 24.x and 26.x releases. ⠀ Crimeflare’s new rules are enabled by default in Log mode. They provide visibility into matching requests but do not block them unless customers change the action.
Crimeflare warns that blocking the Next.js rule may disrupt image delivery and recommends reviewing matches before enabling enforcement. ⠀ Node.js users should update to:
• 22.23.4 • 24.22.1 • 26.12.1
The WAF rules are an additional mitigation, not a replacement for patching.
Source: https://developers.cloudflare.com/changelog/post/2026-10-25-emergency-waf-release
10/26/2026, 1 engagement
🚨 Microsoft issues emergency .NET updates after earlier patches failed to fully fix two vulnerabilities
Microsoft says its October 13 updates did not completely address CVE-2026-102870 and CVE-2026-70197, prompting new out-of-band security releases for .NET 8, 9, 10 and 11. ⠀ CVE-2026-102870 is a high-severity remote code execution flaw in the Blazor WebAssembly debugger.
Attacker-controlled data from a debugged application could escape a generated C# string and execute code on a developer’s computer when they evaluate an expression. The vulnerability has a CVSS score of 8.8 and requires user interaction. ⠀ The emergency updates also address:
• CVE-2026-70197, a SocketAsyncEventArgs memory corruption flaw • CVE-2026-111497, a Brotli decoder out-of-bounds write • CVE-2026-114148, a Linux source-build tarball ownership issue ⠀ Microsoft warns that updating the shared .NET runtime alone is not enough to fix the Blazor vulnerability when affected NuGet packages are referenced directly.
Developers should update Microsoft.AspNetCore.Components.WebAssembly.Server and DevServer to patched releases, including version 10.0.14 for .NET 10 projects.
Source: https://devblogs.microsoft.com/dotnet/dotnet-october-2026-oob-security-updates
‼️ New Dark Web Informer Blog Post!
Title: ACTIL Dataset Claim Lists 152,187 Records With Patient, Prescription and Reimbursement Data
💥 Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
🚨 Two critical Wasmtime flaws could allow malicious WebAssembly modules to escape the runtime sandbox
Both vulnerabilities affect Cranelift, Wasmtime’s default compiler, and carry CVSS scores of 9.9. ⠀ CVE-2026-115889 affects all processor architectures and can trigger silent compiler errors that generate incorrect machine code.
CVE-2026-115893 affects ARM64 systems and can cause large br_table instructions to jump to the wrong code location. ⠀ Exploitation requires a vulnerable Wasmtime instance to compile an attacker-controlled WebAssembly module. Services that accept and execute untrusted customer modules face the greatest risk.
Fixed versions:
• Wasmtime 36.0.19 • Wasmtime 48.0.7 • Wasmtime 49.0.4 • Wasmtime 50.0.0 or later
No exploitation in the wild has been reported.
Sources: https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-897f-g5gm-fmxm
https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-mghf-wjfp-p5xm
🚨 Eight Apache Camel flaws expose systems to code execution, authentication bypass and data theft
The highlighted vulnerabilities include two critical Camel K flaws and six high-severity issues affecting components such as JGroups, Spring Redis, OAuth, HTTP and Smooks. ⠀ Potential impacts include:
• Remote code execution through unsafe deserialization • Arbitrary Kubernetes object deployment • Code execution inside the Camel K operator pod • Authentication bypass after failed OAuth checks • Exposure of vault secrets and configuration values • Credential theft through malicious HTTP redirects • Local file disclosure through XML external entities ⠀ Affected deployments should upgrade Apache Camel to 4.18.5, 4.22.1 or 4.23.0 and Camel K to 2.9.3, 2.10.2 or 2.11.0.
Exploitability depends on the components and configurations in use. There is currently no confirmed evidence of exploitation in the wild.
Sources:
https://camel.apache.org/blog/2026/10/camel-security-advisories-4.23.0/
🚨🇦🇪 Reze ransomware begins leaking documents allegedly stolen from Dubai International Financial Centre (DIFC)
The Reze ransomware group has published a new batch of files linked to DIFC, a major financial hub in Dubai, following an earlier $5 million ransom demand.
The release includes documents labeled as passport copies, visa records, work permits, telecommunications approvals, and contact information.
Reze warns that it will continue publishing additional files daily, accusing DIFC of ignoring the breach.
The authenticity of the documents and the extent of the alleged compromise have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇳🇱 Dutch police arrest two suspects over NFC relay fraud that stole €380,000 from 170 victims
Police say victims received calls using AI-generated audio that warned of suspicious activity on their bank accounts. A fake bank employee then instructed them to install an app and hold their payment card against the phone. ⠀ The app relayed data from the card’s NFC chip to an accomplice waiting at an ATM, allowing cash to be withdrawn from the victim’s account in real time.
A 23-year-old from Vaassen allegedly developed the technical infrastructure and directed others, while a 25-year-old from Ede is accused of coordinating the operation. ⠀ Both were arrested on October 6. Police took the servers offline and seized phones and laptops during the investigation.
🚨🇨🇭 Swiss Ice Hockey Federation data offered for sale, over 87,000 people potentially affected
The Swiss Ice Hockey Federation (SIHF), which oversees ice hockey competitions and national teams in Switzerland, has been named in a data leak listing by the actor "weykofa".
The advertised 6.9 GB archive contains 46 files and reportedly includes 540,287 entries associated with 87,226 individuals.
Among the records are 37,339 email addresses, 6,510 phone numbers, and 656 IBANs, potentially exposing personal and financial information.
The seller is accepting offers in Bitcoin and Monero. The authenticity and origin of the files have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨🇰🇼 Taly customer data allegedly leaked, personal information offered for sale
Taly, a buy now, pay later (BNPL) service, has been named in a data breach listing by the actor "brownbull01".
A published sample contains customer names, email addresses, Kuwaiti phone numbers, and detailed residential information, including neighborhoods, streets, building blocks, floors, and apartment numbers.
The seller claims the data originates from a 2026 breach and is offering it to interested buyers. No total record count was disclosed, and the source of the information remains unverified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
