Top 5 free checkers for PHP2Shell (CVE-2026-109618 / CVE-2026-109619), the critical PHP RCE pair: 1. SOCRadar php2shell Checker (online) 2. Assetnote php2shell-scanner (CLI) 3. ProjectDiscovery Nuclei template (CLI) 4. php2shell[.]site (online, open source) 5. Syhunt php2shell-protection (mitigation test kit) Patch to PHP 8.2.35 / 8.3.36 / 8.4.27 / 8.5.12. Scan only hosts you're authorized to test. socradar.io/free-tools/php2s… #PHP #PHP2Shell #CyberSecurity #InfoSec

🇫🇷 🚨 FRANCE: THREAT ACTOR LEAKS ALLEGED DEKRA.FR DATABASE WITH 16K RECORDS A threat actor on an underground forum has released for free what it claims is a database from dekra[.]fr, the French website of DEKRA, the global vehicle inspection, testing and certification group. The actor claims: * 16,171 lines, about 16 MB * Names, postal addresses, mobile numbers and emails * Inspection job details: technician, inspection dates, report reference, client name and work performed * Sample rows appear tied to energy-renovation inspections (heat pump checks) carried out for energy suppliers The claim has not been independently verified. ⚠️ Analyst Note: If genuine, this exposes homeowners who recently had renovation work inspected, which is ideal bait for fake follow-up inspection calls, fake subsidy (CEE) refunds and SMS phishing using real job details. It is a small set, but it is free, so it will spread fast. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #DEKRA #France #DataLeak #DataBreach #ThreatIntelligence

🚨 Lindt Japan: 3.15 million member records exposed in breach at e-commerce provider futureshop Lindt & Sprüngli Japan says attackers broke into futureshop, the SaaS platform that runs its online shop, and took data on 3,147,469 members of its online shop and official app. futureshop says a server-software vulnerability was exploited on Oct 17–18 (JST); it spotted the access on Oct 19. * Exposed: member IDs, names, emails, addresses, phone numbers, dates of birth, gender and hashed passwords. * Payment card data was not included; the shop does not store card numbers. * Lindt Japan suspended its online shop on Oct 21 and will email affected members from Oct 26. No misuse confirmed so far. futureshop says only this one store's data was taken. The confirmed scope is Lindt Japan's membership, not Lindt's global systems. lindt.jp/contents/chocolat-c… #DataBreach #CyberSecurity #Japan

🚨 Initia exploit: $7.48M in fake tokens drained $2.73M in real coins from bridge reserves On Oct 23, one account on the Initia blockchain created about $7.48M in unbacked tokens in 13 seconds, according to an on-chain investigation by Bitquery. It sent copies of USDC, AUSD and ether back over the bridges, and their reserves paid out about $2.73M in real coins on Ethereum. * Noble's USDC reserve backing USDC on Initia fell from $1.09M to $63 in 36 minutes, and normal user withdrawals bounced as it emptied. * Everything that got out was converted into 1,135.5 ETH in one wallet, still unmoved at Bitquery's Oct 23 18:52 UTC snapshot. * Initia halted the chain 42 minutes after the printing began. Kraken separately paused INIT deposits and withdrawals over an Initia network issue. The $7.48M is face value, not the amount stolen. The loss figure is Bitquery's estimate from a point-in-time wallet read, not a live balance; Initia's own root cause and restart status are not confirmed here. bitquery.io/investigations/i… #Cybercrime #DeFi #Crypto

⚠️ UPDATE: AWS SETS OCT 28 CERTIFICATE DEADLINE AS IT PULLS eMUDHRA-LINKED ROOTS FROM ITS TRUST STORES (CVE-2026-111943) AWS published security bulletin 2026-150-AWS on Oct 24, 2026 (8:00 PM PDT). It is removing three roots tied to the eMudhra intermediate CA key incident from the trust bundles its services use for outbound TLS: AAA Certificate Services, emSign Root TLS CA - G3 and emSign ECC Root CA - G3. * Application Load Balancer (OIDC/JWT auth): if your identity provider's certificate chains to one of these roots, replace it with a certificate from an AWS-trusted CA by Oct 28. Existing ALBs are updated Oct 29-31; new ALBs are protected by Nov 2 * CloudFront: root removal from the edge CA bundle is targeted for Oct 28; origin certificates that chain to these roots may fail TLS validation * Done: shared AWS trust store (Oct 21), STS and Cognito. botocore 1.43.117, Amazon Linux ca-certificates and Corretto updates are out * Still coming: Bottlerocket AMIs (Oct 26), RDS for SQL Server hosts (Oct 30), EMR releases (Oct 31) This is a certificate-trust migration after an external CA's key failure, not a breach of AWS. Affected ALB and CloudFront customers are being notified through AWS Health. Clients that enforce fail-closed revocation checks are not affected. aws.amazon.com/security/secu… #CyberSecurity #AWS #PKI

🇺🇦 🚨 UKRAINE'S PROSECUTOR GENERAL'S OFFICE DATA ALLEGEDLY OFFERED FOR SALE A threat actor on a dark web forum is selling what it claims is about 100 GB of data, more than 97,000 files, taken from the Prosecutor General's Office of Ukraine. The seller claims the dump includes: * Employee data * Internal decrees and procurement records * Files on high-profile criminal cases * Documents related to the Russia-Ukraine war * DOCX, XLSX, PDF, RTF, JPEG and PPT files dated 2020 to 2026 The actor says the data came from a compromised file server and is asking for offers for an exclusive sale. ⚠️ Analyst Note: If genuine, exposure of case files and war-related documents could affect ongoing investigations and national security, not just staff privacy. Ukraine's Prosecutor General's Office has not commented. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ukraine #DataBreach #Government #DataLeak #ThreatIntelligence #CyberSecurity

⚠️ Electrum patches a Bitcoin fee-bump theft trick already used in the wild A malicious Electrum server can hide a payment the user just sent and show a fake look-alike transaction in its place, paying the attacker. If the user then manually bumps its fee (RBF), the wallet signs a real payment to the attacker. * Affected: Electrum before 4.8.3; fixed in 4.8.3, released Oct 24. * Maintainers say some servers are doing this in the wild: two user reports, one with a loss after a fee bump. * The attacker's address was ground to match the last four characters of the real one. * The fix verifies signatures on the wallet's own inputs before showing unconfirmed transactions. This is not a silent drain: it needs a malicious server and a user signing a fee increase. Upgrade, and check recipient addresses and amounts before signing anything. Users on their own trusted server are not affected. github.com/spesmilo/electrum… #Bitcoin #CyberSecurity #Crypto

🇯🇵 🚨 NISSAN CUSTOMER DATABASE ALLEGEDLY OFFERED FOR SALE A threat actor on a dark web forum is selling what it claims are 2.35 million customer records tied to Nissan. The seller's sample allegedly includes: * Full names, cities, states and zip codes * Personal and business email addresses * Phone numbers and company names * Vehicle mileage, dealer numbers and customer DMS status The dealer-number and DMS fields suggest the data comes from a dealer management system or a third-party service platform, not Nissan's core corporate systems. ⚠️ Analyst Note: This may be recirculated data. In April 2026 the Everest group leaked about 900 GB taken from a vendor serving Nissan and Infiniti dealers in North America, and the fields look similar. Nissan has not commented on this new listing. Customers should watch for dealer- or service-themed phishing calls and emails. Unverified threat-actor claim, NOT confirmation of a new breach. #DDW #DarkWeb #Nissan #DataBreach #Automotive #DataLeak #ThreatIntelligence #CyberSecurity

🇸🇬 Singapore healthcare administrator Alliance Medinet confirms breach of about 110,000 members' data Parent company Alliance Healthcare Group told SGX on Oct 24 that a third party accessed Medinet's membership database. * Exposed data includes names, ID numbers and contact details. * Seven members' bank-account details and one member's medical diagnosis may also be affected. * Reported to Singapore's PDPC on Oct 21. Forensic investigation ongoing; members being notified. Insurer Income separately says about 70 people in one corporate account were affected, a subset of the total, not extra victims. No ransomware group or intrusion method has been disclosed. Outsourced health administrators hold data for many insurers and employers at once, so one breach spreads wide. links.sgx.com/1.0.0/corporat… #DataBreach #Singapore #Healthcare

🇲🇽 🚨 THREAT ACTOR CLAIMS BREACH OF COAHUILA STATE GOVERNMENT DATABASE, 2.6M RECORDS (UNVERIFIED) A threat actor calling itself MortemTeam claims it breached a database belonging to the government of Coahuila, the Mexican state on the US border. The actor claims: * About 2.6 million records taken from a Coahuila state government (coahuila.gob.mx) database * The data has been posted on a cybercrime forum The claim was made on October 25, 2026. No sample fields, data dates or price were given, and it has not been independently verified. The Coahuila state government has not publicly confirmed an incident. ⚠️ Analyst Note: Mexican government databases are a frequent target of leak claims, and record counts are often inflated or recycled from older dumps. If genuine, records like these could fuel identity fraud and phishing that impersonates state agencies. Residents should be wary of unexpected messages that claim to come from the state government. We assess this as an unverified threat-actor claim. #DDW #DarkWeb #DataBreach #Mexico #Coahuila #Government #MortemTeam #ThreatIntelligence

⚠️ UPDATE: eMUDHRA CLEANUP GAP: DATADOG'S WINDOWS AGENT STILL TRUSTED CHAINS BUILT ON THE COMPROMISED KEYS Datadog confirmed that its signed 7.84.5 Windows Agent still accepted cross-signed TLS chains using the compromised eMudhra intermediate CA keys. Its embedded Python loads the Windows CA and ROOT stores but never reads the Disallowed store, so the OS-level distrust did not reach it. * Fixed in Datadog Agent 7.84.6 (release notes dated Oct 23, 2026). * The fix backports CPython's key denylist for CVE-2026-115557: any chain containing one of the 8 compromised eMudhra keys is now rejected, whatever trust store it anchors in. * CPython merged that fix upstream on Oct 24. Python runtimes that have not picked it up may still trust these chains. * Sectigo chains and private CAs in the Windows store are not affected. No exploitation or intercepted traffic has been reported, and this is not a Datadog breach. Upgrade Windows agents, and check the trust your Python runtimes actually enforce, not just the OS or CA bundle. github.com/DataDog/datadog-a… #CyberSecurity #SupplyChainSecurity #PKI

🇦🇷 RANSOMWARE DISRUPTS MUNICIPAL SERVICES IN ARGENTINA AMID ATTACK ON IT PROVIDER PGM In Oct 23 notices, the Municipality of Villa Carlos Paz (Córdoba) confirmed a ransomware attack had compromised its systems. Separately, Roldán (Santa Fe) said a cyberattack on municipal IT provider PGM had left it and other municipalities using the service without systems. * Villa Carlos Paz: municipal tax payments and queries are down, including property, vehicle, water and sanitation fees and the misdemeanor court. The scale is still being assessed. * Roldán: administrative offices remain open, but service and some municipal website functions are affected. Villa Carlos Paz's notice does not itself name PGM. The full number of affected municipalities and any data theft remain unverified. villacarlospaz.gov.ar/detall… roldan.gov.ar/wp/2026/10/23/… #Ransomware #Cybersecurity #Argentina

🇧🇪 🚨 AB INBEV LISTED BY "EMPERADOR" RANSOMWARE GROUP The Emperador ransomware group has added AB InBev, the Belgium-based world's largest brewer behind Budweiser, Corona and Stella Artois, to its leak site. The group claims about 3.9 GB of data, including: * ~329,000 social-listening alerts * ~2,510 corporate emails across subsidiaries * ~19,000 access logs and internal portal records * Internal PKI certificates and Azure cloud storage files The group is reportedly demanding $1 million in Bitcoin, with a release timer running to around Nov 23. The claim has not been independently verified, and AB InBev has not publicly confirmed a cyber incident. ⚠️ Analyst Note: The claimed haul is small for a company of this size and leans toward marketing, email and cloud-storage data rather than brewing or production systems. If the PKI certificates are genuine, they would need revocation and rotation. Partners and staff should watch for AB InBev-themed phishing. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ransomware #Emperador #ABInBev #Budweiser #DataLeak #ThreatIntelligence #CyberSecurity

⚠️ UPDATE: LiteLLM SAYS ITS OLD IMAGE-SIGNING KEY WAS LIKELY EXPOSED IN THE SUPPLY-CHAIN ATTACK A maintainer says the team has reason to believe the private half of the old cosign key was exposed during the attacker's credential theft. A valid signature no longer proves a LiteLLM image is clean. * Poisoned v1.107.0 images went through LiteLLM's own release pipeline, carry a valid old-key signature and pass cosign verify. Treat their listed digests as compromised. * Signatures made with the old key before the Oct 21 v1.107.0 release can still be trusted, the maintainer says, but the old key should not be trusted going forward. * From v1.106.3, Docker images and Helm charts are signed with a new cosign key. Verification with the old key will fail. Update pinned cosign.pub files in verify scripts, CI checks and admission policies. Rotating the key does not clean an already compromised host. github.com/BerriAI/litellm/i… #SupplyChainSecurity #AISecurity

🇯🇵 Japan: Sagawa Express says up to 53.23 million personal data records may have leaked The delivery giant's 5th report (Oct 23) on the breach of its online parcel-tracking service puts the maximum at about 53.23 million records, counted with duplicates, so this is not the number of people. * Shipping labels from Jun 21 to Sep 30: sender and recipient names, addresses and phone numbers. You may be in it just for receiving a parcel. * Freight-contract customer list: names, addresses, phone numbers. * Smart Club members: names, addresses, phones, emails and member IDs. No card data or passwords were involved, and handwritten labels are excluded. The intrusion was found Sep 30 and its cause is still under investigation. Tracking is back, but pickup booking and several other web services remain offline. Expect fake "missed delivery" texts and calls posing as Sagawa. www2.sagawa-exp.co.jp/inform… #DataBreach #Japan #Logistics

🇨🇳 🚨 HISENSE NAMED BY "WHITEARMOR" EXTORTION GROUP WhiteArmor, the new data-extortion group behind the Whirlpool and J.B. Hunt claims, has listed Hisense, the Chinese electronics and home appliance giant, on its leak site. The listing reportedly claims: * A warranty-claims archive tied to Hisense operations in Malaysia and Singapore * Customer IDs linked to those claims * Records on roughly 2,500 suppliers The group is reportedly asking $500,000 and has set a late-November release deadline. The claim has not been independently verified, and Hisense has not publicly confirmed a cyber incident. ⚠️ Analyst Note: WhiteArmor surfaced on Oct 21 and has moved quickly through large consumer brands. The claimed scope points to a regional service or warranty system rather than a company-wide breach, and actor-stated figures may be inflated or recycled. Customers in Malaysia and Singapore should watch for warranty or service-themed phishing. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #WhiteArmor #Hisense #Electronics #Extortion #DataLeak #ThreatIntelligence #CyberSecurity

⚠️ UPDATE: ORACLE PULLS eMUDHRA AND COMODO AAA ROOTS FROM JAVA IN NEW SECURITY ALERT (CVE-2026-114820) Oracle issued a second eMudhra-related Security Alert on Oct 24, 2026. Its Oct 21 alert (CVE-2026-91403) distrusted the compromised intermediate CA certificates. The new update removes the root certificates themselves from the JDK cacerts keystore. * Removed: emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 and Comodo's AAA Certificate Services (owned by Sectigo) * CVE-2026-114820, CVSS 3.1 9.1 (JSSE, network, no authentication) * Affected: Oracle Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; GraalVM for JDK 17/21; GraalVM EE 21.3.20.0.2 * Fixed: JDK 27.0.1.0.3, with matching .0.3 baselines for 25, 21, 17 and 11, and 8u511-b33 This is a cleanup step for the eMudhra incident DDW has covered since Oct 20, not a new breach, and no exploitation has been reported. Removing the Comodo root does not mean its key was compromised. If you only patched for the Oct 21 alert, update again, then test anything that still chains to these roots. Check other Java vendors' builds separately. oracle.com/security-alerts/a… #CyberSecurity #Java #PKI

🇯🇵 Japan: Treasure Factory says 746,277 customer email addresses were stolen from its pickup and moving booking system The Tokyo-listed reuse retailer says an attacker exploited a database access vulnerability on Oct 20 and took data before the system was cut off. * 746,277 customer emails (11 also with name and address). * 750 partner and staff names/emails, plus 1,000 device records. * No card or payment data, per the company. * Second group incident since its Kindal unit's August phishing breach. Expect phishing aimed at affected customers. treasure-f.com/info/detail/s… #DataBreach #Japan #CyberSecurity

🚨 Keystone hardware wallet confirms customer data breach Keystone says it detected unauthorized access to its official website on Oct 20. After reviewing API activity with Shopify, it confirmed on Oct 23 that a third party obtained customer shipping information. * Exposed: names, contact details, shipping addresses and order details (items and prices). * Not exposed, per Keystone: payment card or bank details, recovery phrases, private keys or wallet passwords. * Keystone says it blocked the access, patched the issue and is emailing affected customers. It has not said how many people are affected. ⚠️ Analyst Note: Home addresses of hardware-wallet buyers are a known target for phishing, fake "replacement device" parcels and physical threats. Ignore unexpected refund, replacement or address-fix messages, and never enter a recovery phrase anywhere. xitter.cf/KeystoneWallet/status/… #DataBreach #Crypto #CyberSecurity

🇫🇷 🚨 FRANCE: THREAT ACTOR LEAKS ALLEGED MONDIAL RELAY DATABASE WITH 570K RECORDS A threat actor on an underground forum has released for free what it claims is a database from mondialrelay[.]fr, the French parcel delivery and pickup-point network. The actor claims: * 570,000 lines, about 457 MB * Recipient names, postal addresses, emails and phone numbers * Shipment and order numbers with full parcel tracking events * Sample records dated September 2025 The claim has not been independently verified. ⚠️ Analyst Note: If genuine, real tracking numbers plus names and phone numbers make convincing parcel-delivery smishing (fake redelivery fees, fake pickup-point codes). Mondial Relay customers should be wary of any SMS or email asking for payment to release a parcel. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #MondialRelay #France #DataLeak #DataBreach #ThreatIntelligence

🇰🇿 🚨 KAZAKHSTAN: THREAT ACTOR CLAIMS BREACH OF MINISTRY OF INTERNAL AFFAIRS A threat actor on an underground forum claims to have breached the Ministry of Internal Affairs of the Republic of Kazakhstan, the country's police and internal security ministry. The actor claims: * Access gained through unpatched Windows systems, reaching the ministry's central databases * Images of national ID cards and passports with names, dates of birth and national ID numbers * Driving licence and vehicle registration data, including VINs * Disability certificates and medical records, plus property registration documents * Total size reported at about 1.5 TB The claim has not been independently verified. ⚠️ Analyst Note: If genuine, a national identity and vehicle registry dataset from an interior ministry is a goldmine for identity fraud, SIM-swap and loan fraud, and for targeting police personnel. Kazakh citizens should watch for phishing that cites their real ID or vehicle details. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Kazakhstan #Government #DataLeak #DataBreach #ThreatIntelligence