Cesar Chavez Martinez

🏴‍☠️ Speaker 🇵🇪 🇵🇦 🇲🇽 🇧🇴 🇨🇷 🇨🇴 🇨🇱 🇪🇦 🇭🇳 🇵🇷 🇨🇴 🇱🇹 🇵🇦 🇵🇾
🕵#Hacking #Forensic
🎓+4000 face-to-face conferences //500 online conf.

[Rıdvan Yağlı @ridvanyagli]

🔴 Araştırmacı @4osp3l, Microsoft Azure Application Gateway v2 üzerinde ilginç bir 403 Forbidden bypass yöntemi buldu.

403 Forbidden veren bir URL, URL'nin sonuna "?x=.js" ekleyince (veya query string içinde .js geçen herhangi bir şey) kısıtlama bypass oluyor ve sayfaya erişilebiliyor.

[Cesar Chavez Martinez @peruhacking]

El chiste se cuenta solo. Quién plantea los estándares para quién plantea los estándares.

https://t.co/Kuz9RH7bFn

[chum1ng0/security research @chum1ng0]

Hackers chinos espiaron a miles de empresas tras vulnerar la seguridad del gigante tecnológico ConnectWise.

https://t.co/zqffejJIGn

[Zero Day Engineering @zerodayalpha]

⚡️ 0-Day Alert: PHP remote code execution

CVE-2026-109618: OOM bailout to UAF
CVE-2026-109619: state corruption to UAF

We independently scrutinized the bugs, they are legitimate and should be fixed asap.

Update to: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35

[elhacker.NET @elhackernet]

Surge un tercer fallo de PHP2Shell que no recibirá un parche de emergencia

La Fundación PHP informó el viernes que ha reservado un identificador CVE (CVE-2026-115560) para un tercer fallo de RCE que se suma a los dos primeros que componen PHP2Shell, y publicará un aviso completo y el software corregido con la próxima versión regular de PHP
https://t.co/YRVMVGoe3d

[ChatGPT @ChatGPTGoneWild]

BREAKING: Cybersecurity has gone nuclear.

There have been huge security flaws, discovered by AI.

In the last 72 hours:

PHP2Shell: A flaw in the software behind ~70% of websites. Governments took sites offline.
eMudhra: Master keys that verify websites are real were cracked. One was reportedly the number 4.
California: Data on every public school student since 2023 stolen, including disability status.
Railway: Hackers stole customers’ secret keys from a hosting platform used by millions of developers.
Zeabur: 321,810 accounts breached. The company is shutting down.
LiteLLM: An AI tool downloaded 3.4 million times a day was laced with a password stealer.
GitLab: A maximum-severity flaw in every version since 2014.
Cairn: Criminals used an AI hacking tool to break into 100+ companies.
Ahold Delhaize: Hackers knocked the owner of Food Lion and Stop & Shop offline.
Onamae: Malware planted on up to 26,739 customer servers in Japan.

[elhacker.NET @elhackernet]

Php2shell-scanner

Herramienta para escanear php2shell con 3 métodos: vía URL, localhost, SSH
https://t.co/Hsm4cmyFVY

[+Finanz@s @mas_finanzas]

.@SBSPERU plantea estándares obligatorios de API y ciberseguridad para las finanzas abiertas
https://t.co/9sCiFUv41v

[The Hacker News @TheHackersNews]

🚨 Researchers pushed over 2 million remote updates to disable a forgotten Popcorn Time updater that could have fueled a botnet.

The flaw let anyone controlling its update domain deliver code with SYSTEM or root privileges.

How they pulled it off ↓ https://t.co/4fegRwXc90

[Cesar Chavez Martinez @peruhacking]

La web #Lastdragon esta caída ¿phpshell?

[Cesar Chavez Martinez @peruhacking]

Grupo de Telegram exfiltra data de SBS en Darkforums Bitacora de la exfiltración con Cesar Chavez Martinez @peruhacking

[Dark Web Intelligence @DailyDarkWeb]

🇵🇪 🚨 PERU: THREAT ACTOR OFFERS ALLEGED FINANCIAL DATABASE FROM BANKING REGULATOR SBS

A threat actor on a dark web forum is selling what it claims is a large financial database taken from Peru's Superintendency of Banking, Insurance and Private Pension Funds (SBS), the country's financial regulator.

The actor claims:
* About 13 million client records
* About 68 million debt and credit-detail records
* Data on both individuals and companies, covering 2025 to 2026
* Monthly datasets in TXT and SQL formats
* A separate database allegedly from Peru's electoral office (ONPE), offered free to buyers

⚠️ Analyst Note:
If genuine, regulator-level credit and debt data on millions of Peruvians would be a powerful tool for targeted fraud, loan scams and convincing phishing that impersonates banks. The actor sells through private chat channels for cryptocurrency. The SBS had not commented at the time of writing.

This is an unverified threat-actor claim, NOT confirmation that the SBS was breached.

#DDW #DarkWeb #Peru #DataLeak #Finance #ThreatIntelligence

[Cesar Chavez Martinez @peruhacking]

El Canal de Telegram Star, mediante un foro de actores maliciosos, Venden Base de datos 2025-2026 de 13 millones de lineas de SBS

Este conjunto de datos cubre registros financieros históricos y activos desde 2025 hasta 2026, estructurado en combos mensuales

[Cesar Chavez Martinez @peruhacking]

Todo esta consumado, información de la SBS liberada https://t.co/hktJHjEiVe

[Cesar Chavez Martinez @peruhacking]

ALERTA: El Grupo de #Telegram STAR ha liberado muestras de la base de datos de la #SBS, burlándose del comunicado de la SBS, iniciando la venta publica de la información de sus sistemas. Seguiremos informando de este tema

[Cesar Chavez Martinez @peruhacking]

Conforme les anticipe, es momento de la revelación, mas de 32K de credenciales de cuentas filtradas de entidades gubernamentales, compañías aseguradoras, entidades bancarias entre otras
https://t.co/S0ikjOe29S

[Cesar Chavez Martinez @peruhacking]

Conforme a lo previamente anunciado. Está es la información de @SBS que estan ofreciendo los del grupo STARs en Telegram. En fin es cosa de cada uno.

[Infobae Perú @infobaeperu]

Cae presunto hacker que habría vulnerado información del Estado para obtener datos de los familiares su víctima https://t.co/o2cLqziGes

[Cesar Chavez Martinez @peruhacking]

Presente en la presentación de soluciones de emergencia de NETSCOUT ante vulnerabilidades PHP. Las pasarelas de comunicación son esenciales en revisar las interacciones.

[Madison Mills @MadisonMills22]

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios.

The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios.

Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said.

Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior.

Read my latest for Axios here: https://t.co/Q3bda5In8q