botw44 𝕏

.byte 0x0f, 0x3f

[Daniele Berardinelli @rina4_tot]

More details about CVE-2026-109618 and
CVE-2026-109619, the PHP RCE.

Upload progress can serialize before basic RINT clears BG(serialize)

There is currently no possible mitigation.

See the screenshot below to understand how I got the UAF 😼

[International Cyber Digest @IntCyberDigest]

‼️BREAKING: Hackers are planting webshells on Nextcloud servers through a critical Collabora flaw.

CVE-2026-110447 in the built-in CODE Server app lets anyone run commands without logging in.

Collabora says update to 26.4.303 or delete it.

[Brute @BRuteLogic]

unKover v1.3 is out.

Download
https://t.co/D9AvN9F4Lh

Catching 403/401 now, and the 2 new testbed cases:

1. Parser Confusion (breaker + static ext)
2. RFC 7239 Forwarded Header Trust

Test it on
https://t.co/Dn719hCXJi

Don’t let a 403 or 401 stop you.

[Dancho Danchev @dancho_danchev]

Second breach of Silent Ransomware Group's Dark Web Onion. Now chat logs appear. The first breach posted personally identifiable information about the group's operators on their Dark Web Onion.

Reference:

hxxp://h7v7qkdil4lkm3ocwmcudzfmx7xmihtw53n3yk7b2cjtqu3zc4xqo7qd.onion/

hxxp://h7v7qkdil4lkm3ocwmcudzfmx7xmihtw53n3yk7b2cjtqu3zc4xqo7qd.onion/files/chat_export_full.json.gz [GZIP].

[Daniel Heinen @heinenbros]

PSA: For the love of God... please do not do this trend.

[botw44 𝕏 @hack_fish]

@cyb3rops You shouldnt' be using Virtualizor these days.

[Dark Web Informer @DarkWebInformer]

New INC Ransom blog:
incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion

#Ransomware #DarkWeb #DarkWebInformer

[Dark Web Informer @DarkWebInformer]

‼️ New DLS Identified: ShadowByt3S

http://mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad[.]onion

http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad[.]onion

🇺🇾 ShadowByt3S claims to have stolen 9GB of data from Forestal Atlántico Sur including PostgreSQL database dumps, employee records, operational data, and GPS coordinates.

The threat actor is demanding ransom payment within 72 hours or they will sell the complete database.

[Bitshadow @fbgwls245]

New Falcon #Ransomware Leak Site

2 Victims

/i7loab6thvz4lb7jdr3qoeumbvilwhbgnwsctnlfmvsv7g5s3vsiw6yd[.]onion

[Dark Web Informer @DarkWebInformer]

‼️ New Ransomware Group: ZaWoo

Dark Web: https://fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynrnlomu4szf2nyd[.]onion

[Dark Web Informer @DarkWebInformer]

‼️ xpl0itrs Leak Site

IOC: http://2kieaq6jnwgrru62wwtxaafg35q6rzweg7y2xjfnbhvq5wd4eojqv6yd[.]onion

[Nicolas Krassas @Dinosn]

Leaks from hacker forums https://t.co/rQ2nxCABem

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.

The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.

The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.

The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.

Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.

If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at https://t.co/KLv2YiMtpm.

Data surfaced via the Hunt Intelligence, Inc. feed.

[Abdelhamid Naceri @MSNightmare2000]

I'm back (maybe), new drip (blog), got some interesting stuff that might be worth reading,
https://t.co/1tTNdd147c

[botw44 𝕏 @hack_fish]

@WIRED Created a proof of concept here: https://t.co/n64oVrwEif

[botw44 𝕏 @hack_fish]

@WIREDScience Created a proof of concept here: https://t.co/n64oVrwEif

[botw44 𝕏 @hack_fish]

@IntCyberDigest Created a proof of concept here: https://t.co/n64oVrwEif

[botw44 𝕏 @hack_fish]

@P3b7_ Created a proof of concept here: https://t.co/n64oVrwEif

[impulsive @weezerOSINT]

meta gave their AI support agent the ability to modify your instagram account. no identity verification. people figured this out and accounts are being taken over right now

[André @oracles]

Today Instagram had this massive exploit where hackers were just stealing rare handles left and right. Hundreds of accounts gone.

People losing handles they’ve owned since 2010, some worth hundreds of thousands.

I own a few rare ones so I was actually stressed watching this happen in real time, which I haven’t been in years.

Obama White House account got hit.

These aren’t some random new accounts, these are verified, locked down accounts and they still got compromised.

The thing is the exploit is so simple it’s almost funny. Attacker goes to Forgot Password, says their account is hacked, turns on a VPN to match the target’s location (which now you can find on the about section of the page).

Instagram’s AI support flow asks them to verify with a selfie.

They grab a photo from the target’s profile, run it through an AI video generator to make an animation of the person’s face moving around, upload that to Meta’s AI as proof.

And Meta’s AI just accepts it because it can’t tell the difference between a real selfie and an AI-generated video of someone’s face
.
Once verified they change the email to theirs. Password reset link goes to their email. They own it now. 2FA gets bypassed somehow in the process but honestly I don’t know exactly how, just that it did.

Point is even locked down accounts went down.

Then you try to recover your account and you’re talking to a chatbot that has zero ability to help.

You can’t escalate to a human. You’re just stuck. Your asset is gone and there’s no one to call.

The whole thing just highlighted how stupid it is to automate account security without any human in the loop.

One AI fooling another AI while there’s literally no person anywhere to catch it.

Meta took hours to even acknowledge it while accounts were getting stolen every minute.

Now thankfully it’s patched but I don’t think it will be the last one. Stay safe!