Dark Web Informer - Cyber Threat Intelligence

A threat actor posting as xpl0itrs is advertising the sale of data they claim to have taken from RapidFort, a US container hardening and software supply chain security vendor.

Dutch police have seized servers belonging to the pornographic content-sharing platform Motherless as part of an international investigation into suspected child sexual abuse material and videos allegedly depicting drug-facilitated sexual abuse.

CVE-2026-0257 is an authentication bypass in the GlobalProtect portal and gateway components of Palo Alto Networks PAN-OS software.

CVE-2026-50522 is a critical remote code execution vulnerability in on-premises Microsoft SharePoint Server, caused by deserialization of untrusted data (CWE-502).

CVE-2026-42980 is an elevation of privilege vulnerability in the Windows NT OS Kernel, fixed in Microsoft's June 2026 Patch Tuesday.

Hugging Face has disclosed a security breach in which an autonomous AI agent system compromised part of its production infrastructure and gained access to internal datasets and service credentials.

A threat actor posting under the alias PescobarLegado, working with a group identified in the post as NyxarGroup, claims to have obtained internal data from the Secretaría Distrital de Movilidad de Bogotá, the mobility authority under the Bogotá Mayor's Office in Colombia.

A threat actor using the alias bytetobreach is advertising the sale of data they claim to have taken from Georgia's court systems and the High Council of Justice of Georgia.

A newly disclosed OpenSSL flaw named HollowByte allows an unauthenticated attacker to exhaust server memory using specially crafted TLS requests containing as little as 11 bytes of data.

A threat actor using the alias doommageddon claims to have breached Hospital Di Camp, a healthcare facility in Campo Grande, Brazil, that has provided medical services for more than 20 years across fields including cardiology, gastroenterology, and orthopedics.

CVE-2026-54523 (GHSA-79gf-7frw-68m9) is a critical privilege escalation in Kyverno, the CNCF Kubernetes policy engine.

A threat actor using the alias Sensitive2025 is advertising a database they claim to have stolen from Loja Negócios Digital (lojanegociosdigital.com.br), a Brazilian online store.

A threat actor using the alias ChimeraZ claims to be leaking a database from the French Firefighters Federation (Fédération nationale des sapeurs-pompiers de France), specifically its official online membership platform (pompiers.fr).

A threat actor using the alias iProfessor claims to have breached NEBBIA (nebbia.fitness), a premium fitness-apparel and activewear brand headquartered in Žilina, Slovakia, that sells internationally through its online store.

Security researchers have disclosed an unpatched Cursor vulnerability that can allow a malicious Git repository to execute attacker-controlled code automatically when opened on a Windows system.

A threat actor using the alias bytetobreach is advertising the sale of data they claim to have stolen from ANCPI, Romania's National Agency for Cadastre and Land Registration, which maintains the country's land-registry and property records.

Ransomware Attack Update - July 14th, 2026

The U.S. Justice Department has unsealed an indictment charging three Russian nationals and two St. Petersburg-based companies over an alleged bulletproof hosting operation that caused more than $62 million in losses to cybercrime victims.

A threat actor using the alias 888 claims to have leaked a database from Conasems, the National Council of Municipal Health Secretariats of Brazil (Conselho Nacional de Secretarias Municipais de Saúde).

A Welsh man identified as an administrator of the dark web doxing platform Doxbin has been sentenced to prison for encouraging and assisting swatting attacks targeting people and organizations in the United Kingdom, United States, and Canada.