🎬 CYBERSECURITY DOCUMENTARIES WORTH WATCHING Cybersecurity is easier to understand when you study the real stories behind the technology, people, failures, surveillance programs, cyber operations, and criminal ecosystems. Here are some documentaries worth adding to your watchlist: * Hackers (1985) — early hacker culture and the people behind it * In the Realm of the Hackers (2003) — underground hacker communities * Hacking Democracy (2006) — election technology, security, and trust * We Are Legion (2012) — the story of Anonymous and internet activism * Terms and Conditions May Apply (2013) — how personal data is collected and monetized * The Internet’s Own Boy (2014) — Aaron Swartz, information freedom, and activism * Citizenfour (2014) — Snowden, surveillance, and the global privacy debate * Zero Days (2016) — Stuxnet and the rise of cyber weapons * Risk (2016) — the personal and global risks surrounding WikiLeaks and digital activism * The Great Hack (2019) — data exploitation, political profiling, and social media influence * Kill Chain (2020) — election security and foreign interference risks * The Perfect Weapon (2020) — cyber conflict as a geopolitical tool * Web of Make Believe (2022) — online manipulation, conspiracy, fraud, and digital harm * Cyberbunker (2023) — the criminal ecosystem behind one of Europe’s notorious cybercrime hubs Analyst Note: The best cybersecurity documentaries are not just about “hackers.” They explain the bigger picture: * Technology * Human behavior * Surveillance * Geopolitics * Privacy * Disinformation * Cybercrime * Ethics Watch the stories. Then study the systems behind them. #DDW #CyberSecurity #CyberDocumentary #ThreatIntelligence #Cybercrime #Privacy #OSINT #Hacking

🇪🇸 🚨 SPAIN: LAPSUS$-BRANDED ACTOR CLAIMS MADRID FOOTBALL FEDERATION DATA BREACH A threat actor using the LAPSUS$ name is advertising a database they claim was stolen from the Real Federación de Fútbol de Madrid (RFFM), the governing body for football in the Madrid region. The actor claims the data includes: * 100,000+ records from an internal database and document repository * 30,000+ scans of identity documents (DNI/NIE and passports) * Medical certificates * Home addresses, phone numbers and internal records ⚠️ Analyst Note: ID document scans combined with medical certificates are high-value material for identity fraud. The LAPSUS$ name has been reused by unrelated actors before, so attribution is unconfirmed. Unverified threat-actor claim, NOT confirmation that RFFM was breached. #DDW #DarkWeb #RFFM #Spain #DataBreach #LAPSUS #ThreatIntelligence

🇦🇷 🚨 ARGENTINA: THREAT ACTORS CLAIM 3M-RECORD CITIZEN DATABASE FROM SANTA FE PROVINCIAL GOVERNMENT A threat actor group claims to have breached the provincial government of Santa Fe, Argentina, and is offering what it describes as the province's citizen database. The actors claim: * About 3 million citizen records * A full database of about 2.5 GB * The data was listed on an underground forum The claim has not been independently verified, and the Government of Santa Fe has not confirmed any incident. ⚠️ Analyst Note: The post gives no sample fields, date range or proof of how the data was obtained. Argentine provincial governments have been named in a wave of underground claims in recent weeks, including Tucumán and Chaco, and some of these datasets turn out to be recycled or compiled from older leaks. We assess this as an unverified threat-actor claim, NOT confirmation of a compromise of Santa Fe government systems. If authentic, citizen records at this scale could fuel identity fraud and phishing that impersonates provincial agencies. #DDW #DarkWeb #Argentina #SantaFe #Government #DataLeak #ThreatIntelligence #CyberSecurity

LiteLLM suspects AI-gateway logs enabled its release compromise LiteLLM says it observed Claude Code responses containing GitHub CLI OAuth tokens that could enter gateway logs. It suspects attackers accessed its internet-facing internal LiteLLM deployment, stole tokens from those logs and hijacked the release workflow. * An organization-owner token reportedly disabled branch protections. * A lookalike repository supplied the poisoned artifacts. * How attackers entered the gateway remains unconfirmed. The October 21 release compromise is confirmed. This proposed initial-access chain is still under investigation, not proof of a Claude Code vulnerability. docs.litellm.ai/blog/securit… #SupplyChainSecurity #AISecurity

🇺🇸 🚨 KIRKLAND & ELLIS NAMED ON A SECOND EXTORTION LEAK SITE Kirkland & Ellis LLP, the Chicago-headquartered firm widely ranked as the world's highest-grossing law firm, has been added to the "leakeddata" extortion leak site. The entry names the firm but marks the details as "to be announced", so no data volume, file list or samples have been published yet. This is a separate listing from the Cl0p leak-site claim that named Kirkland & Ellis in September 2026. The claim has not been independently verified, and Kirkland & Ellis has not publicly confirmed a new incident. ⚠️ Analyst Note: The leakeddata site has recently listed several major US law firms, and data-extortion crews keep targeting elite firms because their files hold privileged M&A, litigation and restructuring material on major clients. A second, unrelated listing does not prove a breach, and it could reflect reused or third-party data. Treat this as an unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ransomware #DataExtortion #KirklandEllis #LawFirm #LegalSector #DataLeak #ThreatIntelligence #CyberSecurity

ARTEX-linked attacks extend beyond the ConnectWise incident, Wiz reports Wiz has documented related activity across multiple IT and software vendors during October, overlapping with Microsoft's Storm-0940 findings. * Attackers probed account recovery, SSO and cross-tenant access. * Password spraying targeted Okta and Entra environments; Cognito flows were also tested. * Some sessions lasted 24–30 hours, switching addresses or endpoints when blocked. Most attempts failed. This is evidence of sustained targeting, not a newly confirmed mass breach. The practical lesson: correlate application and identity logs across repeated failures, rather than treating each probe in isolation. wiz.io/blog/artex-in-the-wil… #AISecurity #ThreatIntelligence

🇬🇹 🚨 GUATEMALA: TERROAHGROUP CLAIMS BREACH OF ARMS-CONTROL AGENCY DIGECAM AND USAC UNIVERSITY The threat actor TerroahGroup claims to have breached and exfiltrated databases from two Guatemalan institutions: DIGECAM (Dirección General de Control de Armas y Municiones), the state body that registers firearms and ammunition, and the Universidad de San Carlos de Guatemala (USAC), the country's main public university. The actor claims: * Access to databases containing login credentials and user data * Ongoing monitoring of the affected portals * The targets were chosen over alleged security weaknesses ⚠️ Analyst Note: If real, DIGECAM data could touch firearm and ammunition registration records, a serious security and regulatory risk. USAC data could expose students, faculty and staff. TerroahGroup has made a run of claims against Latin American government targets. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Guatemala #DIGECAM #USAC #DataBreach #ThreatIntelligence

🇵🇪 🚨 PERU: THREAT ACTOR LEAKS ALLEGED ESSALUD PATIENT DATABASE A threat actor on a dark web forum has published a database they claim was stolen from EsSalud, Peru's public social health insurance agency, which covers millions of insured workers and their families. The actor claims the data includes: * Full names, DNI (national ID) numbers, gender and addresses * Contact details * Medical record details and consultation notes * Patient complaints, internal system codes and user identifiers ⚠️ Analyst Note: National ID numbers combined with medical history are high-value material for identity theft and health-themed phishing. The internal codes described could point to access to backend or administrative systems, but that is not confirmed. Unverified threat-actor claim, NOT confirmation that EsSalud was breached. #DDW #DarkWeb #EsSalud #Peru #DataBreach #Healthcare #ThreatIntelligence

🇯🇵 🚨 JAPAN: THREAT ACTOR CLAIMS 55 MILLION SOFTBANK CUSTOMER RECORDS FOR SALE A threat actor on a dark web forum is offering a database they say holds 55 million records belonging to customers of SoftBank Corp., one of Japan's largest mobile carriers. The asking price is $500. The actor claims the data includes: * Names, email addresses, phone numbers, street addresses and dates of birth * MSISDN, IMSI and ICCID (phone number and SIM identifiers), plan codes and device details * Billing data such as payment methods and monthly bill amounts ⚠️ Analyst Note: SIM identifiers paired with identity and billing data are ideal material for SIM-swap fraud and convincing carrier-themed phishing. A low price for a dataset this size can point to recycled or inflated data, and a similar SoftBank listing showing only column names circulated earlier this month. Unverified threat-actor claim, NOT confirmation that SoftBank was breached. #DDW #DarkWeb #SoftBank #Japan #DataBreach #SIMSwap #ThreatIntelligence

🇬🇧 🚨 PWC (PRICEWATERHOUSECOOPERS) CLAIMED BY EVEREST RANSOMWARE GANG The Everest ransomware and extortion group has added PwC to its leak site, listing the victim's country as the United Kingdom. PwC is one of the Big Four professional services networks, providing audit, tax, consulting and deal advisory services to major corporations and governments worldwide. The listing names PwC, but no data volume, file list or samples have been published yet, and it does not say which PwC member firm or system was allegedly affected. The claim has not been independently verified, and PwC has not publicly confirmed an incident. ⚠️ Analyst Note: A confirmed breach at a Big Four firm could expose sensitive client audit, tax and advisory files, not just PwC's own data. PwC was also among the organizations named in Clop's 2023 MOVEit campaign. Everest has shifted toward data theft, insider recruitment and access brokering. Treat this as an unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ransomware #Everest #UnitedKingdom #PwC #BigFour #ProfessionalServices #DataLeak #ThreatIntelligence #CyberSecurity

PHP2Shell: AWS reports an attack attempt four days before disclosure Amazon says its MadPot honeypots recorded a PHP2Shell exploitation attempt on October 17, ahead of the October 21 disclosure. * AWS recommends investigating from at least October 17, not just patch day. * It has not established how the actor obtained exploit information. * Whether the observed attempts would succeed against real-world systems remains unclear. Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor’s verified fixed package. Patching does not replace investigation of earlier suspicious activity. aws.amazon.com/blogs/securit… #PHP #CyberSecurity

🇫🇷 LICENSING DATA OF MORE THAN A DOZEN FRENCH SPORTS FEDERATIONS ALLEGEDLY LEAKED A threat actor has published a 2.5 GB archive they claim holds the licensing databases of more than a dozen French sports federations, covering what they say are millions of athletes, coaches and referees. The actor says the data came from unsecured third-party infrastructure used to run the licensing systems. Federations named in the claim include Judo, Badminton, Basketball, Boxing, Dance, Handball, Hockey, Kickboxing, Motorcycling, Swimming and Table Tennis, plus the EPGV. The actor claims the data includes: * Licence IDs, full names and dates of birth * Email addresses and club affiliations * Medical certificate status ⚠️ Analyst Note: If authentic, this is a shared-vendor exposure, and many licence holders are likely minors. Expect phishing that impersonates federations or clubs about "licence renewal" or "medical certificates". The federations may face GDPR notification duties with the CNIL. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #France #Sports #DataBreach #DataLeak #GDPR #ThreatIntelligence

🚨 SOUNDCLOUD USER DATABASE ALLEGEDLY LEAKED VIA EXPOSED S3 BUCKET (2.7 GB) A threat actor on a hacker forum has published a 2.7 GB compressed database they claim was pulled from SoundCloud. The actor says the data was accessed without authentication through a misconfigured, publicly readable AWS S3 bucket. The actor claims the data includes: * User IDs, usernames and email addresses * Artist profiles and track metadata * Premium account and subscription status ⚠️ Analyst Note: If authentic, expect targeted phishing and account-takeover attempts against SoundCloud users and artists. Change reused passwords and treat "account" or "payout" emails with caution. SoundCloud already disclosed a separate breach in late 2025, so part of this data may overlap with older leaks. Unverified threat-actor claim, NOT confirmation of a new breach. #DDW #DarkWeb #SoundCloud #DataBreach #DataLeak #CloudSecurity #ThreatIntelligence

INTERPOL announces 1,462 arrests in Africa-focused cybercrime crackdown Operation Serengeti III brought together 20 African countries and the United States against ransomware, BEC, online fraud and digital extortion. INTERPOL reports: * 10,909 malicious networks disrupted. * More than $105 million in illicit funds recovered. * 65,929 victims identified. The results were disclosed October 22; the operation ran June 29–August 31. Arrests are not convictions, and investigations remain active. interpol.int/News-and-Events… #Cybercrime #INTERPOL

🚨 GITLAB CRITICAL PATCH: CVSS 10.0 UNAUTHENTICATED RCE IN SELF-MANAGED CE/EE (CVE-2026-110264) GitLab released a critical patch on Oct 21, 2026 and urges all self-managed installations to upgrade immediately. What's reported: • CVE-2026-110264: an integer overflow in the regular expression compiler could let an unauthenticated attacker execute arbitrary code on the GitLab server via a crafted regex • CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) • Affects GitLab CE/EE from 7.0 up to the fixed versions • Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 (backports included) • GitLab.com and up-to-date Dedicated tenants are already patched • The same release also fixes high-severity OmniAuth/LDAP account takeover (CVE-2026-15723) and OAuth/OIDC cache poisoning issues ⚠️ Analyst Note: GitLab servers hold source code, CI/CD secrets and deploy tokens, so a pre-auth RCE here is a direct supply-chain risk. Patch internet-facing instances first, then review logs using GitLab's published detections and rotate CI/CD credentials if anything looks suspicious. Even instances patched on Oct 12 still need this release. Source: docs.gitlab.com/releases/pat… #DDW #DarkWeb #GitLab #CVE #RCE #PatchNow #SupplyChain #CyberSecurity

🚨 POLKADOT WARNS: FEARLESS WALLET BROWSER EXTENSION LEAKED PRIVATE KEYS FOR ~20 MONTHS Polkadot issued a security alert on Oct 21, 2026 after an investigation by the Polkadot Technical Fellowship, on behalf of the Polkadot Community Foundation, into the third-party Fearless Wallet browser extension. What's reported: • Extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained malicious code that sent the wallet's private key to an attacker-controlled server when the wallet was unlocked • The code entered the public source on Feb 19, 2025 and was active intermittently until Oct 10, 2026 • 8 users have reported unauthorized transfers totalling 17,286 DOT • Chrome is confirmed affected; the Firefox build uses the same code. The mobile app is not affected unless the same key was imported into the extension ⚠️ Analyst Note: Changing the password or reinstalling does not help, because the key itself is exposed. Anyone who used the extension since Feb 2025 should generate new keys in a different wallet and move funds. Leaked keys can sit unused for months, so the 8 reported victims are likely only part of the exposure. Beware of "fund recovery" scams targeting affected users. Source: xitter.cf/Polkadot/status/211291… #DDW #DarkWeb #Polkadot #FearlessWallet #Crypto #SupplyChain #Infostealer #CyberSecurity

🚨 MYDREAMCOMPANION AI PLATFORM DATABASE ALLEGEDLY LEAKED (2.5M RECORDS) A threat actor on a dark web forum has posted a 1.6 GB database they claim was taken from MyDreamCompanion, an adult AI companion platform. The actor says the dump holds about 2.5 million records from an incident in August 2026. The actor claims the data includes: * Email addresses, full names and password hashes * Payment details (cardholder name, card expiry, payment tokens) and transaction history * IP addresses, device and browser fingerprints, location data * Identity verification data ⚠️ Analyst Note: If authentic, the mix of identity, payment and adult-platform data creates a real risk of fraud and sextortion-style extortion. Users should change reused passwords, watch card statements and treat any message referencing their account as a likely scam. Unverified threat-actor claim, NOT confirmation that the platform was breached. #DDW #DarkWeb #AI #MyDreamCompanion #DataBreach #DataLeak #ThreatIntelligence

🇮🇳 🚨 STATE BANK OF INDIA CONFIRMS CUSTOMER DATA EXPOSED ON THE DARK WEB India's largest lender, State Bank of India (SBI), told the stock exchanges on Oct 21, 2026 that it has had an incident involving the loss of certain customer data. What SBI says: • Oct 16: alerts came in from its threat intelligence provider, India's Defence Cyber Agency and CERT-In about suspected exposure of SBI customer data on the dark web • A preliminary review of about 375,000 records on the dark web found 3,897 customer records with personal data • Fields reportedly include names, registered mobile numbers, dates of birth, gender, emails, home addresses, branch and CIF identifiers, lead IDs, and loan/lead record metadata • Incident response is active, and an independent CERT-In-empanelled firm is investigating the source and extent • SBI says core operations, financial performance and business continuity are not affected ⚠️ Analyst Note: The source of the exposure and whether the wider 375K-record set is genuine are still under investigation. Loan-lead data with phone numbers, DOBs and CIF IDs is ideal for convincing bank-impersonation calls, SMS phishing and SIM-swap attempts. SBI customers should treat unexpected "SBI" loan or KYC contacts with caution. Source: bseindia.com/xml-data/corpfi… #DDW #DarkWeb #SBI #StateBankOfIndia #India #DataBreach #Banking #CyberSecurity

LiteLLM: three compromised developer accounts enabled malicious release LiteLLM says attackers apparently used stolen GitHub CLI OAuth tokens to hijack its release process: * One account changed the workflow. * A second approved production. * A third deleted workflow records. The company has not established how the tokens were stolen. Its October 21 report puts malicious PyPI availability at 11:39–13:23 UTC and Docker Hub exposure at 11:46–14:20 UTC. Private enterprise releases were unaffected, it says. Registry cleanup does not clean previously exposed systems. Isolate, rebuild and rotate reachable credentials from a clean environment. docs.litellm.ai/blog/securit… #SupplyChainSecurity #AISecurity

🚨 RAILWAY CONFIRMS SECURITY INCIDENT: CUSTOMER ENVIRONMENT VARIABLES MAY HAVE BEEN ACCESSED Cloud deployment platform Railway says it detected anomalous activity on October 21 in systems that store customer environment variables. According to Railway's security disclosure, an unauthorized third party may have accessed ENCRYPTED environment variables and, for some of them, obtained the DECRYPTED contents. Those variables can hold: * API keys * Database credentials * Private registry credentials Railway's response so far: * ALL builds and deployments are paused, including for Enterprise customers * All storage bucket credentials are being rotated * Upstream AI inference providers were notified to proactively revoke keys * Affected customers will be contacted directly by email Railway believes the incident is part of a series of attacks targeting platform companies with the aim of compromising AI inference providers. Initial analysis suggests a subset of users may be affected, but Railway recommends ALL users act now. ⚠️ Analyst Note: If you run anything on Railway, rotate every secret stored there (API keys, database and registry credentials) and review service logs for unusual activity. Because deployments are paused, new credentials cannot be rolled out until builds resume, so revoke keys at the provider side where you can. The AI-provider angle matters: stolen inference API keys are routinely resold or abused for compute. blog.railway.com/p/security-… #Railway #DataBreach #CloudSecurity #APIKeys #SupplyChainSecurity #AISecurity #ThreatIntel #DDW

Public PoC claims ASLR-bypass RCE on unpatched PHP A public proof-of-concept exploit has been released on GitHub targeting the PHP session flaws behind "PHP2Shell". The author says it achieves one-shot, fully remote code execution on an unpatched PHP 8.4.26 + Apache stack (mod_php, prefork), bypassing ASLR over plain HTTP with no code added to the target page. * The PoC runs against the official php:8.4.26-apache image; the author reports a 3/3 success rate yielding www-data command execution. * It leaks heap and PHP library addresses to defeat ASLR; the current version needs display_errors=on. * This targets unpatched 8.4.26 - fixed builds already exist. Patch now: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed package. github.com/9bie/php2shell-by… #PHP #CyberSecurity