One guy. Global cybercrime. Tracked so you don't have to. Ransomware, data breaches, dark web activity, darknet markets, IOCs & emerging threats. Stay informed!
The Dark Web
Joined August 2023
- Tweets36K
- Following95
- Followers249K
- Likes33.8K
Pinned Tweet
‼️ Footage of the LeakBase domain administrator getting arrested in Taganrog, Russia.
techcrunch.com/2026/03/25/ru…
Dark Web Informer retweeted
🚨 Critical GitLab flaw allows unauthenticated attackers to execute code on servers
GitLab has patched CVE-2026-97229, a maximum-severity vulnerability affecting Community Edition and Enterprise Edition.
⠀
The integer overflow flaw exists in GitLab’s CI/CD regular expression compiler. Under certain conditions, an attacker can execute arbitrary code on a GitLab server by placing a specially crafted regular expression in a CI/CD configuration.
No authentication or user interaction is required.
⠀
Key details:
• CVSS score: 10.0
• Network-accessible
• No privileges required
• Affects GitLab 19.2 before 19.2.8
• Affects GitLab 19.3 before 19.3.5
• Affects GitLab 19.4 before 19.4.2
⠀
GitLab.com and GitLab Dedicated environments have already been patched. Administrators running self-managed installations should update immediately.
Source: docs.gitlab.com/releases/pat…
🚨 High-severity Node.js flaw could allow remote code execution; CVE-2026-111497
Node.js has patched an out-of-bounds write vulnerability in its bundled Brotli decoder.
⠀
An attacker able to supply malicious Brotli-compressed data to an application could potentially corrupt memory and execute code on the underlying server.
⠀
Affected:
• Node.js 22.x
• Node.js 24.x
• Node.js 26.x
Fixed:
• Node.js 22.23.4
• Node.js 24.22.1
• Node.js 26.12.1
⠀
End-of-life Node.js versions may also be vulnerable and will not receive upstream security updates.
Administrators should upgrade and restart affected services.
Source:
nodejs.org/en/blog/vulnerabi…
Dark Web Informer retweeted
A look at critical PHP vulnerabilities from a darknet forum operator's perspective, revealing just how quickly new exploits are turning into real-world threats.
Dread Thread: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/14d9b2557ae62186394e
Forum updap[.]com has had their site suspended.
The forum was mainly known to repost claims by other actors across different forums.
🚨 EByte ransomware shared on a forum, written in Go
An actor known as "procurator" has shared EByte, a ransomware tool written in Go that reportedly combines ChaCha20 and ECIES encryption to lock files.
The ransomware uses selective encryption, encrypting one byte while leaving the next two unencrypted. The post also mentions a management panel and a decryptor for recovering encrypted files.
The tool's functionality and encryption capabilities have not been independently verified.
💥 No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
🚨 Critical GitLab flaw allows unauthenticated attackers to execute code on servers
GitLab has patched CVE-2026-97229, a maximum-severity vulnerability affecting Community Edition and Enterprise Edition.
⠀
The integer overflow flaw exists in GitLab’s CI/CD regular expression compiler. Under certain conditions, an attacker can execute arbitrary code on a GitLab server by placing a specially crafted regular expression in a CI/CD configuration.
No authentication or user interaction is required.
⠀
Key details:
• CVSS score: 10.0
• Network-accessible
• No privileges required
• Affects GitLab 19.2 before 19.2.8
• Affects GitLab 19.3 before 19.3.5
• Affects GitLab 19.4 before 19.4.2
⠀
GitLab.com and GitLab Dedicated environments have already been patched. Administrators running self-managed installations should update immediately.
Source: docs.gitlab.com/releases/pat…
🚨🇺🇸 South Carolina man arrested after tip involving Google account
Ryan Mark Hannan, 33, was arrested by the Horry County Sheriff’s Office Internet Crimes Against Children Task Force for allegedly possessing child sexual abuse material.
⠀
Investigators opened the case after receiving a tip from the National Center for Missing and Exploited Children regarding suspected criminal activity connected to a Google account.
⠀
Hannan was charged with third-degree sexual exploitation of a minor. Authorities said the charge involved between 26 and 250 images.
Dark Web Informer retweeted
To teach a lesson,
After Wiz rushed to buy php2shell domain and use its marketing machine to steal the spotlight, I spotted "phpbleed" in a recent Calif tweet and bought phpbleed.com before wiz could pull the same stunt again.
A big budget can buy a domain. It shouldn't buy someone else's research credit.
If you have contacts at CISA or in the press, do the right thing: make sure the researchers who actually did the work get the recognition they deserve.
Hack the planet. Credit the researchers.
Rumors circulating that PHP 8.5.12 may still be vulnerable to PHP2Shell...
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
A look at critical PHP vulnerabilities from a darknet forum operator's perspective, revealing just how quickly new exploits are turning into real-world threats.
Dread Thread: https://dreadohblesmagfagqup24vw7catlvmqhhce5itz7wxr4vffgemjzaad[.]onion/post/14d9b2557ae62186394e
Dark Web Informer retweeted
Bro Said Real Devs Don’t Use PHP, Then Got Hit With a $90,000 Reality Check
