.byte 0x0f, 0x3f
Left from Germany
Joined September 2012
- Tweets6.2K
- Following1.9K
- Followers340
- Likes7.6K
botw44 𝕏 retweeted
More details about CVE-2026-109618 and
CVE-2026-109619, the PHP RCE.
Upload progress can serialize before basic RINT clears BG(serialize)
There is currently no possible mitigation.
See the screenshot below to understand how I got the UAF 😼
botw44 𝕏 retweeted
‼️BREAKING: Hackers are planting webshells on Nextcloud servers through a critical Collabora flaw.
CVE-2026-110447 in the built-in CODE Server app lets anyone run commands without logging in.
Collabora says update to 26.4.303 or delete it.
botw44 𝕏 retweeted
unKover v1.3 is out.
Download
github.com/brutelogic/unkove…
Catching 403/401 now, and the 2 new testbed cases:
1. Parser Confusion (breaker + static ext)
2. RFC 7239 Forwarded Header Trust
Test it on
403.brutelogic.net/access/rp…
Don’t let a 403 or 401 stop you.
botw44 𝕏 retweeted
Second breach of Silent Ransomware Group's Dark Web Onion. Now chat logs appear. The first breach posted personally identifiable information about the group's operators on their Dark Web Onion.
Reference:
hxxp://h7v7qkdil4lkm3ocwmcudzfmx7xmihtw53n3yk7b2cjtqu3zc4xqo7qd.onion/
hxxp://h7v7qkdil4lkm3ocwmcudzfmx7xmihtw53n3yk7b2cjtqu3zc4xqo7qd.onion/files/chat_export_full.json.gz [GZIP].
botw44 𝕏 retweeted
New INC Ransom blog:
incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad[.]onion
#Ransomware #DarkWeb #DarkWebInformer
botw44 𝕏 retweeted
‼️ New DLS Identified: ShadowByt3S
http://mfbbt65kir2drc7tuoukwibikgvxquauscnzgbeltkmidjtgqlzm2qad[.]onion
http://sdwbytqeb664krp2wz2qs3lxxah2rhneuotot5hy7g4jpn2pindigcad[.]onion
🇺🇾 ShadowByt3S claims to have stolen 9GB of data from Forestal Atlántico Sur including PostgreSQL database dumps, employee records, operational data, and GPS coordinates.
The threat actor is demanding ransom payment within 72 hours or they will sell the complete database.
botw44 𝕏 retweeted
New Falcon #Ransomware Leak Site
2 Victims
/i7loab6thvz4lb7jdr3qoeumbvilwhbgnwsctnlfmvsv7g5s3vsiw6yd[.]onion
botw44 𝕏 retweeted
‼️ New Ransomware Group: ZaWoo
Dark Web: https://fyenuhkq3pfhnbpidj5jm2fl2lryxip4byhg6eozynrnlomu4szf2nyd[.]onion
botw44 𝕏 retweeted
‼️ xpl0itrs Leak Site
IOC: http://2kieaq6jnwgrru62wwtxaafg35q6rzweg7y2xjfnbhvq5wd4eojqv6yd[.]onion
botw44 𝕏 retweeted
‼️🚨 BREAKING: 320,000 Fortinet firewall devices have been targeted in a campaign that has been dubbed 'FortiBleed'. Attackers were able to confirm 75,000 working credentials against the admin and SSL VPN interfaces.
The victims include really big names like Samsung, Oracle, Spotify, Sony, and more.
The data was first surfaced by researcher Volodymyr "Bob" Diachenko and analyzed by Hudson Rock and SOCRadar. The operation runs as a self-feeding loop. Attackers scan the internet for exposed Fortinet devices, then test each one against a curated list of passwords leaked from earlier Fortinet breaches and infostealer logs. Every successful login gets recorded into a verified database. They then turn each compromised box into a listening post, sniffing the traffic passing through the firewall to harvest fresh credentials, which go straight back into the scanner.
The scale is large. The group ran an estimated 1.16 billion credential attempts against more than 320,000 FortiGate targets, plus 2.1 billion brute-force tries against 160,000 MSSQL servers. In the deeper intrusions they intercept SSL VPN authentication hashes, crack them on a dedicated 45-GPU cluster, and move into internal Active Directory.
Diachenko confirmed full network compromises in Japan, Taiwan, Vietnam, Iraq, and Turkey, including a Turkish NATO defense contractor that had classified defense documents stolen.
If you run Fortinet, act now: rotate every VPN and admin credential, enforce MFA on all external gateways, restrict management access to approved sources, segment internal networks, and audit gateway logs for unusual logins. Hudson Rock has a free domain lookup at hudsonrock.com/fortinet.
Data surfaced via the Hunt Intelligence, Inc. feed.
botw44 𝕏 retweeted
I'm back (maybe), new drip (blog), got some interesting stuff that might be worth reading,
blog.projectnightcrawler.dev…
botw44 𝕏 retweeted
Today Instagram had this massive exploit where hackers were just stealing rare handles left and right. Hundreds of accounts gone.
People losing handles they’ve owned since 2010, some worth hundreds of thousands.
I own a few rare ones so I was actually stressed watching this happen in real time, which I haven’t been in years.
Obama White House account got hit.
These aren’t some random new accounts, these are verified, locked down accounts and they still got compromised.
The thing is the exploit is so simple it’s almost funny. Attacker goes to Forgot Password, says their account is hacked, turns on a VPN to match the target’s location (which now you can find on the about section of the page).
Instagram’s AI support flow asks them to verify with a selfie.
They grab a photo from the target’s profile, run it through an AI video generator to make an animation of the person’s face moving around, upload that to Meta’s AI as proof.
And Meta’s AI just accepts it because it can’t tell the difference between a real selfie and an AI-generated video of someone’s face
.
Once verified they change the email to theirs. Password reset link goes to their email. They own it now. 2FA gets bypassed somehow in the process but honestly I don’t know exactly how, just that it did.
Point is even locked down accounts went down.
Then you try to recover your account and you’re talking to a chatbot that has zero ability to help.
You can’t escalate to a human. You’re just stuck. Your asset is gone and there’s no one to call.
The whole thing just highlighted how stupid it is to automate account security without any human in the loop.
One AI fooling another AI while there’s literally no person anywhere to catch it.
Meta took hours to even acknowledge it while accounts were getting stolen every minute.
Now thankfully it’s patched but I don’t think it will be the last one. Stay safe!
botw44 𝕏 retweeted
‼️ ShinyHunters has leaked 42 Million records of data from Charter Communications.
DentaQuest has also been relisted after being taken down due to possible negotiations.
botw44 𝕏 retweeted
By popular demand
ShinyHunters active onion
/shnyhntww34phqoa6dcgnvps2yu7dlwzmy5lkvejwjdo6z7bmgshzayd[.]onion
Enjoy!
botw44 𝕏 retweeted
🚨Cyber Alert ‼️
🇳🇱Netherlands - ASML Holding N.V.
"1011" threat actor claims to have breached ASML Holding N.V.
Allegedly, the attackers leaked data including approximately 154 SQL databases containing user information, software and device records, and disk encryption keys.
Sector: Manufacturing
Threat class: Cybercrime
Observed: Jan 7, 2026
Status: Pending verification
—
About this post:
Hackmanac provides early warning and cyber situational awareness through its social channels. This alert is based on publicly available information that our analysts retrieved from clear and dark web sources. No confidential or proprietary data was downloaded, copied, or redistributed, and sensitive details were redacted from the attached screenshot(s).
For more details about this incident, our ESIX impact score, and additional context, visit HackRisk.io.
botw44 𝕏 retweeted
🚨Cyberattack Alert ‼️
🇲🇽Mexico - Universidad Nacional Autónoma de México (UNAM)
ByteToBreach threat actor claims to have breached Universidad Nacional Autónoma de México (UNAM).
Allegedly, the attackers conducted a multi-stage intrusion leveraging an F5 BIG-IP vulnerability and multiple internal pivots, deploying custom ransomware primarily for data exfiltration and encryption.
Compromised data reportedly includes student and staff records, emails, databases, directory services data, and internal documents.
Sector: Education
Threat class: Cybercrime
Observed: Jan 7, 2026
Status: Pending verification
—
About this post:
Hackmanac provides early warning and cyber situational awareness through its social channels. This alert is based on publicly available information that our analysts retrieved from clear and dark web sources. No confidential or proprietary data was downloaded, copied, or redistributed, and sensitive details were redacted from the attached screenshot(s).
For more details about this incident, our ESIX impact score, and additional context, visit HackRisk.io.
botw44 𝕏 retweeted
Clarification post, previous post about Ubisoft lead to some confusion. That's my fault. I'll be more verbose. I was trying to compress the information into 1 singular post without it exceeding the word limit.
Here's the word on the internet streets:
- THE FIRST GROUP of individuals exploited a Rainbow 6 Siege service allowing them ban players, modify inventory, etc. These individuals did not touch user data (unsure if they even could). They gifted roughly $339,960,000,000,000 worth of in-game currency to players. Ubisoft will perform a roll back to undo the damages. They're probably annoyed. I cannot go into full details at this time how it was achieved.
- A SECOND GROUP of individuals, unrelated to the FIRST GROUP of individuals, exploited a MongoDB instance from Ubisoft, using MongoBleed, which allowed them (in some capacity) to pivot to an internal Git repository. They exfiltrated a large portion of Ubisoft's internal source code. They assert it is data from the 90's - present, including software development kits, multiplayer services, etc. I have medium to high confidence this true. I've confirmed this with multiple parties.
- A THIRD GROUP of individuals claim to have compromised Ubisoft and exfiltrated user data by exploiting MongoDB via MongoBleed. This group is trying to extort Ubisoft. They have a name for their extortion group and are active on Telegram. However, I have been unable to determine the validity of their claims.
- A FOURTH GROUP of individuals assert the SECOND group of individuals are LYING and state the SECOND GROUP has had access to the Ubisoft internal source code for awhile. However, they state the SECOND GROUP is trying to hide behind the FIRST GROUP to masquerade as them and give them a reason to leak the source code in totality. The FIRST GROUP and FOURTH GROUP is frustrated by this
Will the SECOND GROUP leak the source code? Is the SECOND GROUP telling the truth? Did the SECOND GROUP lie and have access to Ubisoft code this whole time? Was it MongoBleed? Will the FIRST GROUP get pinned for this? Who is this mysterious THIRD GROUP? Is this group related to any of the other groups?
Find out next time on Dragon Ball Z
