Pinned Tweet
Top 5 free checkers for PHP2Shell (CVE-2026-109618 / CVE-2026-109619), the critical PHP RCE pair:
1. SOCRadar php2shell Checker (online)
2. Assetnote php2shell-scanner (CLI)
3. ProjectDiscovery Nuclei template (CLI)
4. php2shell[.]site (online, open source)
5. Syhunt itigation test kit)
Patch to PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Scan only hosts you're authorized to test.
socradar.io/free-tools/php…
#PHP #PHP2Shell #CyberSecurity #InfoSec
1. SOCRadar php2shell Checker (online)
2. Assetnote php2shell-scanner (CLI)
3. ProjectDiscovery Nuclei template (CLI)
4. php2shell[.]site (online, open source)
5. Syhunt itigation test kit)
Patch to PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Scan only hosts you're authorized to test.
socradar.io/free-tools/php…
#PHP #PHP2Shell #CyberSecurity #InfoSec
7
95
407
24,866
🇰🇼 🚨 KUWAIT: THREAT ACTOR SELLS ALLEGED BLIZZARD COMPUTER STORE CUSTOMER AND PAYMENT DATA
A threat actor on an underground forum is selling what it claims is customer and payment data from blizzardkw[.]com, Blizzard Computer Store, a Kuwaiti gaming PC and computer hardware aims:
* 5,706 customer records with names, emails and mobile numbers
* 4,196 payment records with invoice numbers, bank and gateway (KNET) details and amounts
* Payment entries dated as recently as Oct 24 2026
* Advertised as "perfect PII, banking details for phishing" for $75
The claim has not been independently verified.
⚠️ Analyst Note:
If genuine, matching names, phone numbers and real invoice amounts enable very convincing payment-follow-up phishing and fake refund calls. It is small but cheap and fresh. Unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: x.com/DailyDarkWeb/c…
#DDW #DarkWeb #Kuwait #Retail #DataLeak #DataBreach #ThreatIntelligence
A threat actor on an underground forum is selling what it claims is customer and payment data from blizzardkw[.]com, Blizzard Computer Store, a Kuwaiti gaming PC and computer hardware aims:
* 5,706 customer records with names, emails and mobile numbers
* 4,196 payment records with invoice numbers, bank and gateway (KNET) details and amounts
* Payment entries dated as recently as Oct 24 2026
* Advertised as "perfect PII, banking details for phishing" for $75
The claim has not been independently verified.
⚠️ Analyst Note:
If genuine, matching names, phone numbers and real invoice amounts enable very convincing payment-follow-up phishing and fake refund calls. It is small but cheap and fresh. Unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: x.com/DailyDarkWeb/c…
#DDW #DarkWeb #Kuwait #Retail #DataLeak #DataBreach #ThreatIntelligence
1
0
2
2,363
SECRA breach: holiday-property access codes may be exposed
SECRA, a HomeToGo subsidiary providing booking software, says attackers exported data from its systems. It detected the incident on October 23.
Its advice goes beyond password resets:
* Reset electronic-lock PINs and or affected properties as soon as possible.
* Treat SECRA integration keys, tokens, passwords and portal passwords as compromised and replace them immediately.
* Guests should confirm access codes with their property's official contact before arrival.
SECRA says personal and booking data may also be affected and could enable convincing payment scams. It has found no evidence of misuse so far.
secra.de/sicherheitsvor…
#DataBreach #CyberSecurity
SECRA, a HomeToGo subsidiary providing booking software, says attackers exported data from its systems. It detected the incident on October 23.
Its advice goes beyond password resets:
* Reset electronic-lock PINs and or affected properties as soon as possible.
* Treat SECRA integration keys, tokens, passwords and portal passwords as compromised and replace them immediately.
* Guests should confirm access codes with their property's official contact before arrival.
SECRA says personal and booking data may also be affected and could enable convincing payment scams. It has found no evidence of misuse so far.
secra.de/sicherheitsvor…
#DataBreach #CyberSecurity
2
0
0
2,888
🇮🇱 🚨 ISRAEL: THREAT ACTOR CLAIMS TO SELL 4.5TB OF MINISTRY OF DEFENSE, MOSSAD AND IDF DATA
A threat actor using the name "UNC6783" claims to be selling about 4.5TB of data it says comes from Israeli defense and intelligence bodies. The only sale terms given are "Price? e claimed breakdown:
* Israel Ministry of Defense: 2.5TB (claimed)
* Mossad: 1TB (claimed)
* Israel Defense Forces (IDF): 1TB (claimed)
The only proof shared is a screenshot of directory listings. No sample files, record counts or forum listing were provided.
Earlier this month, an actor linked to the same alias advertised a "4.5TB" Israeli military cache on an underground forum under different labels (Israel Aerospace Industries, Rafael and the IDF), and separately claimed a ~5TB Israeli Ministry of Defense dataset. Forum users questioned the samples in that earlier listing.
The claim has not been independently verified, and we found no official confirmation of any breach.
⚠️ Analyst Note:
Anyone can use the UNC6783 name, and nothing here ties this post to the group Google Threat Intelligence tracks under that designation. Sale claims about Israeli defense and intelligence agencies are often exaggerated or recycled, and this one reuses the same 4.5TB figure as the earlier listing with new labels, which points to repackaging rather than a fresh intrusion. Directory listings alone are not proof of access or of what the files contain. We assess this as an unverified threat-actor claim, NOT confirmation of a breach of the Israeli Ministry of Defense, Mossad or the IDF. If any of it is authentic, it could feed influence operations, targeting of personnel and defense-themed phishing.
#DDW #DarkWeb #Israel #Mossad #IDF #UNC6783 #ThreatIntelligence #CyberSecurity
A threat actor using the name "UNC6783" claims to be selling about 4.5TB of data it says comes from Israeli defense and intelligence bodies. The only sale terms given are "Price? e claimed breakdown:
* Israel Ministry of Defense: 2.5TB (claimed)
* Mossad: 1TB (claimed)
* Israel Defense Forces (IDF): 1TB (claimed)
The only proof shared is a screenshot of directory listings. No sample files, record counts or forum listing were provided.
Earlier this month, an actor linked to the same alias advertised a "4.5TB" Israeli military cache on an underground forum under different labels (Israel Aerospace Industries, Rafael and the IDF), and separately claimed a ~5TB Israeli Ministry of Defense dataset. Forum users questioned the samples in that earlier listing.
The claim has not been independently verified, and we found no official confirmation of any breach.
⚠️ Analyst Note:
Anyone can use the UNC6783 name, and nothing here ties this post to the group Google Threat Intelligence tracks under that designation. Sale claims about Israeli defense and intelligence agencies are often exaggerated or recycled, and this one reuses the same 4.5TB figure as the earlier listing with new labels, which points to repackaging rather than a fresh intrusion. Directory listings alone are not proof of access or of what the files contain. We assess this as an unverified threat-actor claim, NOT confirmation of a breach of the Israeli Ministry of Defense, Mossad or the IDF. If any of it is authentic, it could feed influence operations, targeting of personnel and defense-themed phishing.
#DDW #DarkWeb #Israel #Mossad #IDF #UNC6783 #ThreatIntelligence #CyberSecurity
1
10
31
4,799
🇧🇷 🚨 THREAT ACTOR WHITEARMOR CLAIMS BRAZIL'S LIBERAL PARTY (PL)
The data-extortion group WhiteArmor has listed Brazil's Partido Liberal (PL) on its leak site.
PL is the party of former president Jair Bolsonaro, and his son, Senator Flávio Bolsonaro, is its 2026 presidential does not state a data volume or what was taken. PL has not publicly confirmed an incident, and the claim has not been verified.
⚠️ Analyst Note:
Party systems hold member lists, donor records and campaign communications, and leaks during an election year can be used for targeted phishing, doxxing and disinformation. Treat any "leaked PL documents" that circulate with caution until they are authenticated. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #WhiteArmor #Brazil #Brasil #PartidoLiberal #Elections #DataLeak #ThreatIntelligence #CyberSecurity
The data-extortion group WhiteArmor has listed Brazil's Partido Liberal (PL) on its leak site.
PL is the party of former president Jair Bolsonaro, and his son, Senator Flávio Bolsonaro, is its 2026 presidential does not state a data volume or what was taken. PL has not publicly confirmed an incident, and the claim has not been verified.
⚠️ Analyst Note:
Party systems hold member lists, donor records and campaign communications, and leaks during an election year can be used for targeted phishing, doxxing and disinformation. Treat any "leaked PL documents" that circulate with caution until they are authenticated. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #WhiteArmor #Brazil #Brasil #PartidoLiberal #Elections #DataLeak #ThreatIntelligence #CyberSecurity
12
61
374
18,134
🇲🇲 🚨 QILIN RANSOMWARE CLAIMS MYANMAR MOBILE OPERATOR OOREDOO MYANMAR (U9)
The Qilin ransomware group has listed "Ooredoo Myanmar" on its leak site.
The operator was sold by Qatar's Ooredoo Group to Singapore-based Nine Communications in a deal completed in May 2024 and has ember 2025. It reported about 8.5 million mobile connections in mid-2025.
The listing gives no description, data volume or samples. The operator has not publicly confirmed an incident, and the claim has not been verified.
⚠️ Analyst Note:
Telecom operators hold subscriber identity, SIM registration and call-detail records, and in Myanmar that data is especially sensitive for activists and journalists. Subscribers should be alert to SIM-swap attempts and operator-themed scams. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Qilin #Myanmar #Telecom #U9 #DataLeak #ThreatIntelligence #CyberSecurity
The Qilin ransomware group has listed "Ooredoo Myanmar" on its leak site.
The operator was sold by Qatar's Ooredoo Group to Singapore-based Nine Communications in a deal completed in May 2024 and has ember 2025. It reported about 8.5 million mobile connections in mid-2025.
The listing gives no description, data volume or samples. The operator has not publicly confirmed an incident, and the claim has not been verified.
⚠️ Analyst Note:
Telecom operators hold subscriber identity, SIM registration and call-detail records, and in Myanmar that data is especially sensitive for activists and journalists. Subscribers should be alert to SIM-swap attempts and operator-themed scams. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Qilin #Myanmar #Telecom #U9 #DataLeak #ThreatIntelligence #CyberSecurity
1
1
1
3,030
🇺🇸 🚨 QILIN RANSOMWARE CLAIMS GLOBAL LAW FIRM WHITE & CASE
The Qilin ransomware group has added White & Case, one of the world's largest international law firms, to its leak site.
The listing names the firm under law and legal services. Qilin has not stated a data volume or posted fing so far.
White & Case has not publicly confirmed an incident, and the claim has not been verified.
⚠️ Analyst Note:
Elite law firms hold M&A, litigation and regulatory files for major corporations and governments, which makes them high-value extortion targets. Qilin is one of the most active ransomware operations of 2026, and law firms have been frequent extortion targets this month. Clients should watch for firm-themed phishing, fake invoices and payment-change requests. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Qilin #WhiteCase #LawFirm #Legal #DataLeak #ThreatIntelligence #CyberSecurity
The Qilin ransomware group has added White & Case, one of the world's largest international law firms, to its leak site.
The listing names the firm under law and legal services. Qilin has not stated a data volume or posted fing so far.
White & Case has not publicly confirmed an incident, and the claim has not been verified.
⚠️ Analyst Note:
Elite law firms hold M&A, litigation and regulatory files for major corporations and governments, which makes them high-value extortion targets. Qilin is one of the most active ransomware operations of 2026, and law firms have been frequent extortion targets this month. Clients should watch for firm-themed phishing, fake invoices and payment-change requests. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Qilin #WhiteCase #LawFirm #Legal #DataLeak #ThreatIntelligence #CyberSecurity
4
0
7
3,213
🇫🇷 🚨 FRANCE: THREAT ACTOR LEAKS ALLEGED 4.1M-LINE DATABASE OF MACRON'S RENAISSANCE PARTY
A threat actor on an underground forum has released for free what it calls a partial database from parti-renaissance[.]fr, the website of Renaissance, the French political party founded by ctor claims:
* 4,157,404 lines of door-to-door canvassing data with addresses
* Voters count of 9,617,987 and 373,906 addresses
* 1,547 employee records
* About 10,000 party event records with organiser names and locations
The claim has not been independently verified.
⚠️ Analyst Note:
If genuine, this maps where a governing party canvasses and who organises its events, which is useful for targeted harassment, disinformation and spear-phishing of activists and staff ahead of elections. Unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: x.com/DailyDarkWeb/c…
#DDW #DarkWeb #Renaissance #France #DataLeak #DataBreach #ThreatIntelligence
A threat actor on an underground forum has released for free what it calls a partial database from parti-renaissance[.]fr, the website of Renaissance, the French political party founded by ctor claims:
* 4,157,404 lines of door-to-door canvassing data with addresses
* Voters count of 9,617,987 and 373,906 addresses
* 1,547 employee records
* About 10,000 party event records with organiser names and locations
The claim has not been independently verified.
⚠️ Analyst Note:
If genuine, this maps where a governing party canvasses and who organises its events, which is useful for targeted harassment, disinformation and spear-phishing of activists and staff ahead of elections. Unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: x.com/DailyDarkWeb/c…
#DDW #DarkWeb #Renaissance #France #DataLeak #DataBreach #ThreatIntelligence
1
3
7
2,997
🇺🇸 🚨 RANSOMWARE GROUP CLAIMS MASS TORT LAW FIRM WEITZ & LUXENBERG
A group calling itself "Falcon" has listed Weitz & Luxenberg, the New York plaintiffs' law firm known for asbestos and mass tort litigation, on its leak site.
The group claims an 82 GB extraction that it says includesents, court stipulations and other case files.
Weitz & Luxenberg has not publicly confirmed an incident, and the data has not been verified.
⚠️ Analyst Note:
Mass tort firms hold medical records, settlement details and personal data for large numbers of injured clients, which makes them attractive extortion targets. Falcon is a newly active brand that also listed Astrana Health this week. Clients and opposing counsel should watch for firm-themed phishing, fake settlement notices and payment-change requests. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Falcon #WeitzLuxenberg #LawFirm #Legal #DataLeak #ThreatIntelligence #CyberSecurity
A group calling itself "Falcon" has listed Weitz & Luxenberg, the New York plaintiffs' law firm known for asbestos and mass tort litigation, on its leak site.
The group claims an 82 GB extraction that it says includesents, court stipulations and other case files.
Weitz & Luxenberg has not publicly confirmed an incident, and the data has not been verified.
⚠️ Analyst Note:
Mass tort firms hold medical records, settlement details and personal data for large numbers of injured clients, which makes them attractive extortion targets. Falcon is a newly active brand that also listed Astrana Health this week. Clients and opposing counsel should watch for firm-themed phishing, fake settlement notices and payment-change requests. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Falcon #WeitzLuxenberg #LawFirm #Legal #DataLeak #ThreatIntelligence #CyberSecurity
2
1
7
3,826
🇺🇸 🚨 SECOND RANSOMWARE GROUP CLAIMS ASTRANA HEALTH DATA
A group calling itself "Falcon" has listed Astrana Health (NASDAQ: ASTH), the California physician-management and healthcare services company, on its leak site.
The group claims a 738 GB extraction that it says includes regulatory files.
This is the second extortion claim against Astrana this month. The Chaos ransomware group listed the company on Oct 9, claiming 1,500 GB including patient data.
Astrana disclosed a material cybersecurity incident to the SEC in September. It said attackers spoofed its main corporate phone number and impersonated staff to socially engineer access, and that some confidential information was accessed or taken. The company has not confirmed ransomware or either group's claims.
⚠️ Analyst Note:
Two groups claiming one victim can mean data resale, an affiliate switching brands, or a recycled claim. Neither data volume has been verified. Patients, providers and payer partners should watch for Astrana-themed phishing and calls. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Falcon #AstranaHealth #ASTH #Healthcare #DataLeak #ThreatIntelligence #CyberSecurity
A group calling itself "Falcon" has listed Astrana Health (NASDAQ: ASTH), the California physician-management and healthcare services company, on its leak site.
The group claims a 738 GB extraction that it says includes regulatory files.
This is the second extortion claim against Astrana this month. The Chaos ransomware group listed the company on Oct 9, claiming 1,500 GB including patient data.
Astrana disclosed a material cybersecurity incident to the SEC in September. It said attackers spoofed its main corporate phone number and impersonated staff to socially engineer access, and that some confidential information was accessed or taken. The company has not confirmed ransomware or either group's claims.
⚠️ Analyst Note:
Two groups claiming one victim can mean data resale, an affiliate switching brands, or a recycled claim. Neither data volume has been verified. Patients, providers and payer partners should watch for Astrana-themed phishing and calls. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ransomware #Falcon #AstranaHealth #ASTH #Healthcare #DataLeak #ThreatIntelligence #CyberSecurity
2
0
3
3,779
🇫🇷 🚨 FRANCE: THREAT ACTOR LEAKS ALLEGED DEKRA.FR DATABASE WITH 16K RECORDS
A threat actor on an underground forum has released for free what it claims is a database from dekra[.]fr, the French website of DEKRA, the global vehicle inspection, testing and he actor claims:
* 16,171 lines, about 16 MB
* Names, postal addresses, mobile numbers and emails
* Inspection job details: technician, inspection dates, report reference, client name and work performed
* Sample rows appear tied to energy-renovation inspections (heat pump checks) carried out for energy suppliers
The claim has not been independently verified.
⚠️ Analyst Note:
If genuine, this exposes homeowners who recently had renovation work inspected, which is ideal bait for fake follow-up inspection calls, fake subsidy (CEE) refunds and SMS phishing using real job details. It is a small set, but it is free, so it will spread fast. Unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: x.com/DailyDarkWeb/c…
#DDW #DarkWeb #DEKRA #France #DataLeak #DataBreach #ThreatIntelligence
A threat actor on an underground forum has released for free what it claims is a database from dekra[.]fr, the French website of DEKRA, the global vehicle inspection, testing and he actor claims:
* 16,171 lines, about 16 MB
* Names, postal addresses, mobile numbers and emails
* Inspection job details: technician, inspection dates, report reference, client name and work performed
* Sample rows appear tied to energy-renovation inspections (heat pump checks) carried out for energy suppliers
The claim has not been independently verified.
⚠️ Analyst Note:
If genuine, this exposes homeowners who recently had renovation work inspected, which is ideal bait for fake follow-up inspection calls, fake subsidy (CEE) refunds and SMS phishing using real job details. It is a small set, but it is free, so it will spread fast. Unverified threat-actor claim, NOT confirmation of a breach.
Source: this is for subscribers only. Subscribe: x.com/DailyDarkWeb/c…
#DDW #DarkWeb #DEKRA #France #DataLeak #DataBreach #ThreatIntelligence
1
0
3
3,744
🚨 Lindt Japan: 3.15 million member records exposed in breach at e-commerce provider futureshop
Lindt & Sprüngli Japan says attackers broke into futureshop, the SaaS platform that runs its online shop, and took data on 3,147,469 members of its online shop and official app. futuftware vulnerability was exploited on Oct 17–18 (JST); it spotted the access on Oct 19.
* Exposed: member IDs, names, emails, addresses, phone numbers, dates of birth, gender and hashed passwords.
* Payment card data was not included; the shop does not store card numbers.
* Lindt Japan suspended its online shop on Oct 21 and will email affected members from Oct 26. No misuse confirmed so far.
futureshop says only this one store's data was taken. The confirmed scope is Lindt Japan's membership, not Lindt's global systems.
lindt.jp/contents/choco…
#DataBreach #CyberSecurity #Japan
Lindt & Sprüngli Japan says attackers broke into futureshop, the SaaS platform that runs its online shop, and took data on 3,147,469 members of its online shop and official app. futuftware vulnerability was exploited on Oct 17–18 (JST); it spotted the access on Oct 19.
* Exposed: member IDs, names, emails, addresses, phone numbers, dates of birth, gender and hashed passwords.
* Payment card data was not included; the shop does not store card numbers.
* Lindt Japan suspended its online shop on Oct 21 and will email affected members from Oct 26. No misuse confirmed so far.
futureshop says only this one store's data was taken. The confirmed scope is Lindt Japan's membership, not Lindt's global systems.
lindt.jp/contents/choco…
#DataBreach #CyberSecurity #Japan
2
3
5
4,273
🚨 Initia exploit: $7.48M in fake tokens drained $2.73M in real coins from bridge reserves
On Oct 23, one account on the Initia blockchain created about $7.48M in unbacked tokens in 13 seconds, according to an on-chain investigation by Bitquery. It sent copies of USDC, AUSD and dges, and their reserves paid out about $2.73M in real coins on Ethereum.
* Noble's USDC reserve backing USDC on Initia fell from $1.09M to $63 in 36 minutes, and normal user withdrawals bounced as it emptied.
* Everything that got out was converted into 1,135.5 ETH in one wallet, still unmoved at Bitquery's Oct 23 18:52 UTC snapshot.
* Initia halted the chain 42 minutes after the printing began. Kraken separately paused INIT deposits and withdrawals over an Initia network issue.
The $7.48M is face value, not the amount stolen. The loss figure is Bitquery's estimate from a point-in-time wallet read, not a live balance; Initia's own root cause and restart status are not confirmed here.
bitquery.io/investigations…
#Cybercrime #DeFi #Crypto
On Oct 23, one account on the Initia blockchain created about $7.48M in unbacked tokens in 13 seconds, according to an on-chain investigation by Bitquery. It sent copies of USDC, AUSD and dges, and their reserves paid out about $2.73M in real coins on Ethereum.
* Noble's USDC reserve backing USDC on Initia fell from $1.09M to $63 in 36 minutes, and normal user withdrawals bounced as it emptied.
* Everything that got out was converted into 1,135.5 ETH in one wallet, still unmoved at Bitquery's Oct 23 18:52 UTC snapshot.
* Initia halted the chain 42 minutes after the printing began. Kraken separately paused INIT deposits and withdrawals over an Initia network issue.
The $7.48M is face value, not the amount stolen. The loss figure is Bitquery's estimate from a point-in-time wallet read, not a live balance; Initia's own root cause and restart status are not confirmed here.
bitquery.io/investigations…
#Cybercrime #DeFi #Crypto
2
0
3
4,211
⚠️ UPDATE: AWS SETS OCT 28 CERTIFICATE DEADLINE AS IT PULLS eMUDHRA-LINKED ROOTS FROM ITS TRUST STORES (CVE-2026-111943)
AWS published security bulletin 2026-150-AWS on Oct 24, 2026 (8:00 PM PDT). It is removing three roots tied to the eMudhra intermediate CA key incident from ervices use for outbound TLS: AAA Certificate Services, emSign Root TLS CA - G3 and emSign ECC Root CA - G3.
* Application Load Balancer (OIDC/JWT auth): if your identity provider's certificate chains to one of these roots, replace it with a certificate from an AWS-trusted CA by Oct 28. Existing ALBs are updated Oct 29-31; new ALBs are protected by Nov 2
* CloudFront: root removal from the edge CA bundle is targeted for Oct 28; origin certificates that chain to these roots may fail TLS validation
* Done: shared AWS trust store (Oct 21), STS and Cognito. botocore 1.43.117, Amazon Linux ca-certificates and Corretto updates are out
* Still coming: Bottlerocket AMIs (Oct 26), RDS for SQL Server hosts (Oct 30), EMR releases (Oct 31)
This is a certificate-trust migration after an external CA's key failure, not a breach of AWS. Affected ALB and CloudFront customers are being notified through AWS Health. Clients that enforce fail-closed revocation checks are not affected.
aws.amazon.com/security/secur…
#CyberSecurity #AWS #PKI
AWS published security bulletin 2026-150-AWS on Oct 24, 2026 (8:00 PM PDT). It is removing three roots tied to the eMudhra intermediate CA key incident from ervices use for outbound TLS: AAA Certificate Services, emSign Root TLS CA - G3 and emSign ECC Root CA - G3.
* Application Load Balancer (OIDC/JWT auth): if your identity provider's certificate chains to one of these roots, replace it with a certificate from an AWS-trusted CA by Oct 28. Existing ALBs are updated Oct 29-31; new ALBs are protected by Nov 2
* CloudFront: root removal from the edge CA bundle is targeted for Oct 28; origin certificates that chain to these roots may fail TLS validation
* Done: shared AWS trust store (Oct 21), STS and Cognito. botocore 1.43.117, Amazon Linux ca-certificates and Corretto updates are out
* Still coming: Bottlerocket AMIs (Oct 26), RDS for SQL Server hosts (Oct 30), EMR releases (Oct 31)
This is a certificate-trust migration after an external CA's key failure, not a breach of AWS. Affected ALB and CloudFront customers are being notified through AWS Health. Clients that enforce fail-closed revocation checks are not affected.
aws.amazon.com/security/secur…
#CyberSecurity #AWS #PKI
2
8
30
5,626
🇺🇦 🚨 UKRAINE'S PROSECUTOR GENERAL'S OFFICE DATA ALLEGEDLY OFFERED FOR SALE
A threat actor on a dark web forum is selling what it claims is about 100 GB of data, more than 97,000 files, taken from the Prosecutor General's Office of Ukraine.
The seller claims the dump includes:
nal decrees and procurement records
* Files on high-profile criminal cases
* Documents related to the Russia-Ukraine war
* DOCX, XLSX, PDF, RTF, JPEG and PPT files dated 2020 to 2026
The actor says the data came from a compromised file server and is asking for offers for an exclusive sale.
⚠️ Analyst Note:
If genuine, exposure of case files and war-related documents could affect ongoing investigations and national security, not just staff privacy. Ukraine's Prosecutor General's Office has not commented. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ukraine #DataBreach #Government #DataLeak #ThreatIntelligence #CyberSecurity
A threat actor on a dark web forum is selling what it claims is about 100 GB of data, more than 97,000 files, taken from the Prosecutor General's Office of Ukraine.
The seller claims the dump includes:
nal decrees and procurement records
* Files on high-profile criminal cases
* Documents related to the Russia-Ukraine war
* DOCX, XLSX, PDF, RTF, JPEG and PPT files dated 2020 to 2026
The actor says the data came from a compromised file server and is asking for offers for an exclusive sale.
⚠️ Analyst Note:
If genuine, exposure of case files and war-related documents could affect ongoing investigations and national security, not just staff privacy. Ukraine's Prosecutor General's Office has not commented. Unverified threat-actor claim, NOT confirmation of a breach.
#DDW #DarkWeb #Ukraine #DataBreach #Government #DataLeak #ThreatIntelligence #CyberSecurity
2
0
3
4,509
⚠️ Electrum patches a Bitcoin fee-bump theft trick already used in the wild
A malicious Electrum server can hide a payment the user just sent and show a fake look-alike transaction in its place, paying the attacker. If the user then manually bumps its fee (RBF), the wallet signs ttacker.
* Affected: Electrum before 4.8.3; fixed in 4.8.3, released Oct 24.
* Maintainers say some servers are doing this in the wild: two user reports, one with a loss after a fee bump.
* The attacker's address was ground to match the last four characters of the real one.
* The fix verifies signatures on the wallet's own inputs before showing unconfirmed transactions.
This is not a silent drain: it needs a malicious server and a user signing a fee increase. Upgrade, and check recipient addresses and amounts before signing anything. Users on their own trusted server are not affected.
github.com/spesmilo/elect…
#Bitcoin #CyberSecurity #Crypto
A malicious Electrum server can hide a payment the user just sent and show a fake look-alike transaction in its place, paying the attacker. If the user then manually bumps its fee (RBF), the wallet signs ttacker.
* Affected: Electrum before 4.8.3; fixed in 4.8.3, released Oct 24.
* Maintainers say some servers are doing this in the wild: two user reports, one with a loss after a fee bump.
* The attacker's address was ground to match the last four characters of the real one.
* The fix verifies signatures on the wallet's own inputs before showing unconfirmed transactions.
This is not a silent drain: it needs a malicious server and a user signing a fee increase. Upgrade, and check recipient addresses and amounts before signing anything. Users on their own trusted server are not affected.
github.com/spesmilo/elect…
#Bitcoin #CyberSecurity #Crypto
3
0
6
4,585
🇯🇵 🚨 NISSAN CUSTOMER DATABASE ALLEGEDLY OFFERED FOR SALE
A threat actor on a dark web forum is selling what it claims are 2.35 million customer records tied to Nissan.
The seller's sample allegedly includes:
* Full names, cities, states and zip codes
* Personal and business numbers and company names
* Vehicle mileage, dealer numbers and customer DMS status
The dealer-number and DMS fields suggest the data comes from a dealer management system or a third-party service platform, not Nissan's core corporate systems.
⚠️ Analyst Note:
This may be recirculated data. In April 2026 the Everest group leaked about 900 GB taken from a vendor serving Nissan and Infiniti dealers in North America, and the fields look similar. Nissan has not commented on this new listing. Customers should watch for dealer- or service-themed phishing calls and emails. Unverified threat-actor claim, NOT confirmation of a new breach.
#DDW #DarkWeb #Nissan #DataBreach #Automotive #DataLeak #ThreatIntelligence #CyberSecurity
A threat actor on a dark web forum is selling what it claims are 2.35 million customer records tied to Nissan.
The seller's sample allegedly includes:
* Full names, cities, states and zip codes
* Personal and business numbers and company names
* Vehicle mileage, dealer numbers and customer DMS status
The dealer-number and DMS fields suggest the data comes from a dealer management system or a third-party service platform, not Nissan's core corporate systems.
⚠️ Analyst Note:
This may be recirculated data. In April 2026 the Everest group leaked about 900 GB taken from a vendor serving Nissan and Infiniti dealers in North America, and the fields look similar. Nissan has not commented on this new listing. Customers should watch for dealer- or service-themed phishing calls and emails. Unverified threat-actor claim, NOT confirmation of a new breach.
#DDW #DarkWeb #Nissan #DataBreach #Automotive #DataLeak #ThreatIntelligence #CyberSecurity
2
17
45
9,757
🇸🇬 Singapore healthcare administrator Alliance Medinet confirms breach of about 110,000 members' data
Parent company Alliance Healthcare Group told SGX on Oct 24 that a third party accessed Medinet's membership database.
* Exposed data includes names, ID numbers and contact s' bank-account details and one member's medical diagnosis may also be affected.
* Reported to Singapore's PDPC on Oct 21. Forensic investigation ongoing; members being notified.
Insurer Income separately says about 70 people in one corporate account were affected, a subset of the total, not extra victims.
No ransomware group or intrusion method has been disclosed. Outsourced health administrators hold data for many insurers and employers at once, so one breach spreads wide.
links.sgx.com/1.0.0/corporat…
#DataBreach #Singapore #Healthcare
Parent company Alliance Healthcare Group told SGX on Oct 24 that a third party accessed Medinet's membership database.
* Exposed data includes names, ID numbers and contact s' bank-account details and one member's medical diagnosis may also be affected.
* Reported to Singapore's PDPC on Oct 21. Forensic investigation ongoing; members being notified.
Insurer Income separately says about 70 people in one corporate account were affected, a subset of the total, not extra victims.
No ransomware group or intrusion method has been disclosed. Outsourced health administrators hold data for many insurers and employers at once, so one breach spreads wide.
links.sgx.com/1.0.0/corporat…
#DataBreach #Singapore #Healthcare
2
2
9
4,750
🇲🇽 🚨 THREAT ACTOR CLAIMS BREACH OF COAHUILA STATE GOVERNMENT DATABASE, 2.6M RECORDS (UNVERIFIED)
A threat actor calling itself MortemTeam claims it breached a database belonging to the government of Coahuila, the Mexican state on the US border.
The actor claims:
* About 2.6 rom a Coahuila state government (coahuila.gob.mx) database
* The data has been posted on a cybercrime forum
The claim was made on October 25, 2026. No sample fields, data dates or price were given, and it has not been independently verified. The Coahuila state government has not publicly confirmed an incident.
⚠️ Analyst Note:
Mexican government databases are a frequent target of leak claims, and record counts are often inflated or recycled from older dumps. If genuine, records like these could fuel identity fraud and phishing that impersonates state agencies. Residents should be wary of unexpected messages that claim to come from the state government. We assess this as an unverified threat-actor claim.
#DDW #DarkWeb #DataBreach #Mexico #Coahuila #Government #MortemTeam #ThreatIntelligence
A threat actor calling itself MortemTeam claims it breached a database belonging to the government of Coahuila, the Mexican state on the US border.
The actor claims:
* About 2.6 rom a Coahuila state government (coahuila.gob.mx) database
* The data has been posted on a cybercrime forum
The claim was made on October 25, 2026. No sample fields, data dates or price were given, and it has not been independently verified. The Coahuila state government has not publicly confirmed an incident.
⚠️ Analyst Note:
Mexican government databases are a frequent target of leak claims, and record counts are often inflated or recycled from older dumps. If genuine, records like these could fuel identity fraud and phishing that impersonates state agencies. Residents should be wary of unexpected messages that claim to come from the state government. We assess this as an unverified threat-actor claim.
#DDW #DarkWeb #DataBreach #Mexico #Coahuila #Government #MortemTeam #ThreatIntelligence
1
2
10
5,322
⚠️ UPDATE: eMUDHRA CLEANUP GAP: DATADOG'S WINDOWS AGENT STILL TRUSTED CHAINS BUILT ON THE COMPROMISED KEYS
Datadog confirmed that its signed 7.84.5 Windows Agent still accepted cross-signed TLS chains using the compromised eMudhra intermediate CA keys. Its embedded Python loads stores but never reads the Disallowed store, so the OS-level distrust did not reach it.
* Fixed in Datadog Agent 7.84.6 (release notes dated Oct 23, 2026).
* The fix backports CPython's key denylist for CVE-2026-115557: any chain containing one of the 8 compromised eMudhra keys is now rejected, whatever trust store it anchors in.
* CPython merged that fix upstream on Oct 24. Python runtimes that have not picked it up may still trust these chains.
* Sectigo chains and private CAs in the Windows store are not affected.
No exploitation or intercepted traffic has been reported, and this is not a Datadog breach. Upgrade Windows agents, and check the trust your Python runtimes actually enforce, not just the OS or CA bundle.
github.com/DataDog/datado…
#CyberSecurity #SupplyChainSecurity #PKI
Datadog confirmed that its signed 7.84.5 Windows Agent still accepted cross-signed TLS chains using the compromised eMudhra intermediate CA keys. Its embedded Python loads stores but never reads the Disallowed store, so the OS-level distrust did not reach it.
* Fixed in Datadog Agent 7.84.6 (release notes dated Oct 23, 2026).
* The fix backports CPython's key denylist for CVE-2026-115557: any chain containing one of the 8 compromised eMudhra keys is now rejected, whatever trust store it anchors in.
* CPython merged that fix upstream on Oct 24. Python runtimes that have not picked it up may still trust these chains.
* Sectigo chains and private CAs in the Windows store are not affected.
No exploitation or intercepted traffic has been reported, and this is not a Datadog breach. Upgrade Windows agents, and check the trust your Python runtimes actually enforce, not just the OS or CA bundle.
github.com/DataDog/datado…
#CyberSecurity #SupplyChainSecurity #PKI
2
3
10
4,954
🇦🇷 RANSOMWARE DISRUPTS MUNICIPAL SERVICES IN ARGENTINA AMID ATTACK ON IT PROVIDER PGM
In Oct 23 notices, the Municipality of Villa Carlos Paz (Córdoba) confirmed a ransomware attack had compromised its systems. Separately, Roldán (Santa Fe) said a cyberattack on municipal IT t and other municipalities using the service without systems.
* Villa Carlos Paz: municipal tax payments and queries are down, including property, vehicle, water and sanitation fees and the misdemeanor court. The scale is still being assessed.
* Roldán: administrative offices remain open, but service and some municipal website functions are affected.
Villa Carlos Paz's notice does not itself name PGM. The full number of affected municipalities and any data theft remain unverified.
villacarlospaz.gov.ar/detallenoticia…
roldan.gov.ar/wp/2026/10/23/…
#Ransomware #Cybersecurity #Argentina
In Oct 23 notices, the Municipality of Villa Carlos Paz (Córdoba) confirmed a ransomware attack had compromised its systems. Separately, Roldán (Santa Fe) said a cyberattack on municipal IT t and other municipalities using the service without systems.
* Villa Carlos Paz: municipal tax payments and queries are down, including property, vehicle, water and sanitation fees and the misdemeanor court. The scale is still being assessed.
* Roldán: administrative offices remain open, but service and some municipal website functions are affected.
Villa Carlos Paz's notice does not itself name PGM. The full number of affected municipalities and any data theft remain unverified.
villacarlospaz.gov.ar/detallenoticia…
roldan.gov.ar/wp/2026/10/23/…
#Ransomware #Cybersecurity #Argentina
1
8
47
6,117