‼️ BREAKING: Unauthenticated attackers are hijacking Plex Media Servers.
Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.
A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
Exploit code was published on GitHub on 16 October, immediately after exploitation in the wild began.
A researcher reports a honeypot running Plex was turned into a crypto miner and a proxy.
https://www.boredhackerblog.info/2026/10/plex-vulnerabilities-being-exploited-in.html
😱7😭3❤1🔥1🤣1
Media is too big
VIEW IN TELEGRAM
`🚨 EXCLUSIVE: Meta Ad Campaign Exposes AI-Generated Priest Scam
We uncovered a Meta ad campaign seeking donations for prosthetic legs for Father Miguel, an AI-generated priest.
Scammers used AI, religion and disability to steal money from users of Facebook, Instagram and WhatsApp via Meta ads.
The ads ran from a Facebook page called Miguel between 26 September and 18 October. Meta’s Ad Library lists about 170 versions in French and Spanish.
The biggest ran on Facebook, Instagram, WhatsApp, Threads and Meta’s Audience Network. All are now inactive.
One ad reached 9,565 accounts in France. Nearly 8 in 10 were women, and most were over 45.
It says Miguel is a priest in a town of 5,000 people in São Paulo state, Brazil. The Spanish donation site says the organiser is in Colombia.
An AI-detection scan scored Father Miguel’s face 0.91 for AI generation.
The crucifix reads “VDX” instead of INRI, his face changes from photo to photo, and his wheelchair warps.
The sites are built to look like GoFundMe pages, down to GoFundMe’s own typeface. None of them is on GoFundMe.
The donations shown are static code, fake.
Two of them send donors to the exact same six payment links, from $25 to $1,000.
In the Spanish version, the medical note says both legs were amputated above the knee, while the clinic quote prices below-knee prostheses.
The note is signed in the name of a real Brazilian haematologist. No evidence he wrote it.
The trail leads to Brazil. Donations go through a checkout from Stelar (Brazilian payments platform) with Stripe card fields.
Visitors are tracked by Metrito (Brazilian ad-tracking service). Some code comments are in Portuguese.
Meta lists a Brazilian sole trader (registered in Roraima in May as a driver-for-hire business) as payer for the French ads.
The Spanish ads name a car repair business in Rondônia whose website has nothing to do with Miguel.
Either identity may have been misused.
The checkout preselects a $5 add-on and names no merchant or charity.
Stelar’s terms say sellers plug in their own payment gateway. Meta, Stelar and Stripe hold the records that would show who is behind the ads and who gets the money.
Meta removed one version of the ad for “Unacceptable business practices”, while others kept running until 18 October.
The donation sites are still online today.
🤣11😱3❤2
❗️ The FBI says Jonathan Kramer, 21, secretly ran a pro-ISIS SimpleX account that talked about attacks, then got hold of a rifle.
The account told its SimpleX group the app was "100% anonymous".
The FBI says it unmasked him anyway, using Reddit and Amazon records, a stakeout and a paid informant.
Agents seized his rifle and about 190 rounds from his Pennsylvania hotel room and bags on 12 September.
He hid behind the name "Hamza Al Rashid" on SimpleX, a messenger that needs no phone number or email.
Separately, Discord flagged "alternate" accounts that shared IP addresses or browser cookies with Kramer's known accounts.
One of them, last used from his home internet connection, sent users to a Discord profile showing a masked man in front of the ISIS flag.
Hamza Al Rashid had also called SimpleX "the most secure messenger available".
Weeks later, a Reddit account registered to Kramer's email wrote "simplex is where its at".
Hamza Al Rashid offered to chat at "7PM mecca time", noon in Pennsylvania, which the FBI says fits Kramer's night shifts.
Agents watched Kramer being driven to work at 9:41PM and home at 6:31AM.
The paid informant chatted with Hamza Al Rashid, who laid out a plan to blind a crowd with pepper grenades.
Amazon records show Kramer had bought pepper spray.
A federal grand jury indicted him on 6 October for receiving the rifle to commit terrorism for ISIS.
He has pleaded not guilty.
https://www.justice.gov/usao-wdpa/media/1461241/dl
The account told its SimpleX group the app was "100% anonymous".
The FBI says it unmasked him anyway, using Reddit and Amazon records, a stakeout and a paid informant.
Agents seized his rifle and about 190 rounds from his Pennsylvania hotel room and bags on 12 September.
He hid behind the name "Hamza Al Rashid" on SimpleX, a messenger that needs no phone number or email.
Separately, Discord flagged "alternate" accounts that shared IP addresses or browser cookies with Kramer's known accounts.
One of them, last used from his home internet connection, sent users to a Discord profile showing a masked man in front of the ISIS flag.
Hamza Al Rashid had also called SimpleX "the most secure messenger available".
Weeks later, a Reddit account registered to Kramer's email wrote "simplex is where its at".
Hamza Al Rashid offered to chat at "7PM mecca time", noon in Pennsylvania, which the FBI says fits Kramer's night shifts.
Agents watched Kramer being driven to work at 9:41PM and home at 6:31AM.
The paid informant chatted with Hamza Al Rashid, who laid out a plan to blind a crowd with pepper grenades.
Amazon records show Kramer had bought pepper spray.
A federal grand jury indicted him on 6 October for receiving the rifle to commit terrorism for ISIS.
He has pleaded not guilty.
https://www.justice.gov/usao-wdpa/media/1461241/dl
🤣14❤3👏2💩1
‼️ BREAKING: The man charged with bugging an OpenAI executive meeting room frequently messaged a Saudi royal on WhatsApp.
The royal wrote "Saudi needs you more then the US!"
After his arrest, a Saudi military member paid to fly his wife and baby son to Doha.
https://www.cnbc.com/2026/10/19/openai-bugging-suspect-alfozan-saudi-royal-family.html
The royal wrote "Saudi needs you more then the US!"
After his arrest, a Saudi military member paid to fly his wife and baby son to Doha.
https://www.cnbc.com/2026/10/19/openai-bugging-suspect-alfozan-saudi-royal-family.html
💩16😁5🤣2
‼️BREAKING: A leak site published 421.179 internal emails from Germany's far-right AfD, including the mailbox of ex-leader Alexander Gauland.
ICD found it shows AI-written summaries, not the emails. The newest is from 12 September.
Its own index file names a server "afd_exfil".
https://hexane.cc/
ICD found it shows AI-written summaries, not the emails. The newest is from 12 September.
Its own index file names a server "afd_exfil".
https://hexane.cc/
🤣11👍7
❗️ The AfD leak site's thousands of emails shows nazism from party members and staff labeled under racism/antisemitism.
We went through the worst:
1. A 2018 email forwarded by Alexander Gauland concerns a "Hitler-Wallfahrt", a Hitler pilgrimage, by a former judge at the party's Thuringia arbitration court.
2. A member joked in a district WhatsApp group about turning refugees into handbags and boots, an allusion to the Nazi camps.
3. A district chairman quit, saying a board member sent a "Heil Hitler" Christmas card with a swastika and it was laughed off.
4. A Bavarian official urged party leaders to chant "Merkel verrecke", roughly "Merkel, croak", every day.
5. Federal party staff discussed luring a photographer to an event to remove him by force. The thread signs off "Heil und Sieg".
6. A 2025 NRW email is titled "Sale of swastika flags and drugs at the info stand".
7. This year alone, branches moved against members over a Nazi banner with a swastika, a Hitler impression and a call for machine guns against Arab clans.
We went through the worst:
1. A 2018 email forwarded by Alexander Gauland concerns a "Hitler-Wallfahrt", a Hitler pilgrimage, by a former judge at the party's Thuringia arbitration court.
2. A member joked in a district WhatsApp group about turning refugees into handbags and boots, an allusion to the Nazi camps.
3. A district chairman quit, saying a board member sent a "Heil Hitler" Christmas card with a swastika and it was laughed off.
4. A Bavarian official urged party leaders to chant "Merkel verrecke", roughly "Merkel, croak", every day.
5. Federal party staff discussed luring a photographer to an event to remove him by force. The thread signs off "Heil und Sieg".
6. A 2025 NRW email is titled "Sale of swastika flags and drugs at the info stand".
7. This year alone, branches moved against members over a Nazi banner with a swastika, a Hitler impression and a call for machine guns against Arab clans.
😁13🔥7🤬4❤1💩1🥴1
‼️ DHS political appointees asked CISA to secretly obtain a voting machine and hack it
The findings were only to be shared with the White House, and the vendor was not to be told of any flaws
CISA employees feared they were being asked to participate in political interference
The findings were only to be shared with the White House, and the vendor was not to be told of any flaws
CISA employees feared they were being asked to participate in political interference
🤔14🥴3🤣3❤1💩1
International Cyber Digest
‼️BREAKING: A leak site published 421.179 internal emails from Germany's far-right AfD, including the mailbox of ex-leader Alexander Gauland. ICD found it shows AI-written summaries, not the emails. The newest is from 12 September. Its own index file names…
‼️ UPDATE: The hacker behind the AfD email leak told us they got in through a single unpatched party website.
They also say a 302GB torrent holds the full mailboxes.
The hacker told us "the goal was not destruction, we could've brought cluster and its backups down". They just wanted to expose the "degeneracy and hypocrisy" of the AfD.
They say all AfD sites run on one shared hosting cluster, so one outdated site let them escalate privileges, reach the rest and mount a mail backup.
The leak site is down, which the hacker blames on a DDoS attack. Cloudflare shows an error saying the site's own server is not connected.
They also say a 302GB torrent holds the full mailboxes.
The hacker told us "the goal was not destruction, we could've brought cluster and its backups down". They just wanted to expose the "degeneracy and hypocrisy" of the AfD.
They say all AfD sites run on one shared hosting cluster, so one outdated site let them escalate privileges, reach the rest and mount a mail backup.
The leak site is down, which the hacker blames on a DDoS attack. Cloudflare shows an error saying the site's own server is not connected.
🔥13💩5
‼️UPDATE: Someone offered the hacker behind the AfD email leak €100,000 to take the leak site offline, the hacker told us.
An anonymous Proton Mail user wrote "How can we get in touch? We would pay you money to take the site offline."
The hacker is keeping the website online.
The hackers has been reading the AI comments online, and would like you to know that they've used AI, because reading 400,000 mails is impossible without it.
An anonymous Proton Mail user wrote "How can we get in touch? We would pay you money to take the site offline."
The hacker is keeping the website online.
The hackers has been reading the AI comments online, and would like you to know that they've used AI, because reading 400,000 mails is impossible without it.
🔥18💩4👍1
We will be releasing our first analysis of the AfD files shortly. Please bear with us.
❤11
While you are waiting, be sure to subscribe to our FREE newsletter: https://www.internationalcyberdigest.com/newsletter/
If you like our work, you can support us check https://www.internationalcyberdigest.com/donate/
If you like our work, you can support us check https://www.internationalcyberdigest.com/donate/
International Cyber Digest
Newsletter
Subscribe to the International Cyber Digest Brief for cybersecurity stories, sources, and analysis.
❤3
‼️BREAKING: The hacker behind the AfD email leak told us they targeted the party to expose what they call its greed and financial misuse.
"Hacktivism is often the only answer to populism of this magnitude."
"The AFD takes a legitimate frustration and uses it to rob the poorest 20% of this country," they wrote.
"The amount of financial misuse in these documents is appalling, regardless of what you think of immigrants."
"Hacktivism is often the only answer to populism of this magnitude."
"The AFD takes a legitimate frustration and uses it to rob the poorest 20% of this country," they wrote.
"The amount of financial misuse in these documents is appalling, regardless of what you think of immigrants."
❤5