π¨ Two VLC Media Player flaws can allow code execution and leak sensitive memory
Security researchers have disclosed two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23.
β
CVE-2026-56711, rated 8.6, is a heap out-of-bounds write caused by an integer overflow in VLC's picture buffer allocation.
An attacker can craft a malicious PNG with manipulated dimensions that causes VLC to allocate an undersized memory buffer before writing beyond its boundaries.
The flaw can potentially lead to arbitrary code execution when the malicious image is opened directly or loaded through a playlist.
β
CVE-2026-73324, rated 6.9, affects VLC's RealRTSP handling.
A malicious RTSP server can send an oversized response that causes VLC to read beyond an allocated buffer and return adjacent heap memory to the attacker, potentially exposing sensitive information.
β
The vulnerable RealRTSP component is enabled in official VideoLAN builds, although some Linux distribution packages may compile VLC without it.
β
As of September 11, VLC 3.0.23 remains the current stable desktop release listed by VideoLAN and is affected by both vulnerabilities.
Users should avoid opening untrusted image files or RealRTSP playlist links until an updated release addressing the flaws becomes available.
Source: https://securityonline.info/vlc-media-player-vulnerabilities/
Security researchers have disclosed two vulnerabilities affecting VLC Media Player versions 3.0.0 through 3.0.23.
β
CVE-2026-56711, rated 8.6, is a heap out-of-bounds write caused by an integer overflow in VLC's picture buffer allocation.
An attacker can craft a malicious PNG with manipulated dimensions that causes VLC to allocate an undersized memory buffer before writing beyond its boundaries.
The flaw can potentially lead to arbitrary code execution when the malicious image is opened directly or loaded through a playlist.
β
CVE-2026-73324, rated 6.9, affects VLC's RealRTSP handling.
A malicious RTSP server can send an oversized response that causes VLC to read beyond an allocated buffer and return adjacent heap memory to the attacker, potentially exposing sensitive information.
β
The vulnerable RealRTSP component is enabled in official VideoLAN builds, although some Linux distribution packages may compile VLC without it.
β
As of September 11, VLC 3.0.23 remains the current stable desktop release listed by VideoLAN and is affected by both vulnerabilities.
Users should avoid opening untrusted image files or RealRTSP playlist links until an updated release addressing the flaws becomes available.
Source: https://securityonline.info/vlc-media-player-vulnerabilities/
β€3
βΌοΈ New Dark Web Informer Blog Post!
Title: Boulanger Dataset Claim Covers 132,230 Customer and Service Records
Link: https://darkwebinformer.com/boulanger-dataset-claim-covers-132-230-customer-and-service-records/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Boulanger Dataset Claim Covers 132,230 Customer and Service Records
Link: https://darkwebinformer.com/boulanger-dataset-claim-covers-132-230-customer-and-service-records/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Boulanger Dataset Claim Covers 132,230 Customer and Service Records
A forum actor posting as fuie has uploaded what they claim is a database belonging to Boulanger, a French consumer electronics and home-appliance retailer.
π¨ GitLab CVSS 10 vulnerability exploited just one day after disclosure
Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.
β
The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.
Affected versions include:
β’ GitLab 18.7 through versions before 19.1.8
β’ GitLab 19.2 through versions before 19.2.6
β’ GitLab 19.3 through versions before 19.3.2
β
GitLab disclosed and patched the vulnerability on September 10.
Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.
β
Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.
GitLab.com is already patched.
Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances.
β
The flaw allows an unauthenticated attacker to read arbitrary files from a vulnerable GitLab server using a single HTTP request.
Affected versions include:
β’ GitLab 18.7 through versions before 19.1.8
β’ GitLab 19.2 through versions before 19.2.6
β’ GitLab 19.3 through versions before 19.3.2
β
GitLab disclosed and patched the vulnerability on September 10.
Just one day later, watchTowr began observing in-the-wild exploitation attempts and warns that mass exploitation is likely to follow.
β
Administrators should upgrade immediately to GitLab 19.1.8, 19.2.6, 19.3.2, or a newer supported release.
GitLab.com is already patched.
Source: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-3-2-released/
πͺ That Dark Web Guy - Part 3 πͺ
π¨ GitLab CVSS 10 vulnerability exploited just one day after disclosure Threat actors have begun exploiting CVE-2026-85706, a critical path traversal vulnerability affecting self-hosted GitLab Community and Enterprise Edition instances. β The flaw allows anβ¦
π¨ CVE-2026-85706: An unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7β19.1.7; 19.2.0β19.2.5; 19.3.0β19.3.1
PoC: https://github.com/guneykabel/cve-2026-85706
PoC: https://github.com/guneykabel/cve-2026-85706
GitHub
GitHub - guneykabel/cve-2026-85706: Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affectingβ¦
Exploit poc for CVE-2026-85706 an unauthenticated arbitrary file read on Gitlab CE-EE affecting versions: 18.7β19.1.7; 19.2.0β19.2.5; 19.3.0β19.3.1 - guneykabel/cve-2026-85706
βΌοΈ Darknet Markets Timeline was updated to show that DarkMattter Market is exit scamming. I'm in the process of updating the timeline to look and feel better as well as provide more information.
https://darkwebinformer.com/darknet-markets-timeline/
https://darkwebinformer.com/darknet-markets-timeline/
Dark Web Informer
Darknet Markets Timeline
βΌοΈ New Dark Web Informer Blog Post!
Title: Citya Immobilier Dataset Claim Covers 2.2M+ Records and ~50K Digicodes
Link: https://darkwebinformer.com/citya-immobilier-dataset-claim-covers-2-2m-records-and-50k-digicodes/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Title: Citya Immobilier Dataset Claim Covers 2.2M+ Records and ~50K Digicodes
Link: https://darkwebinformer.com/citya-immobilier-dataset-claim-covers-2-2m-records-and-50k-digicodes/
π₯ Get early visibility into underground claims, including unblurred screenshots, before they turn into headlines: https://darkwebinformer.com/pricing
Dark Web Informer
Citya Immobilier Dataset Claim Covers 2.2M+ Records and ~50K Digicodes
A forum actor posting as ChimeraZ is selling what they claim is a database belonging to Citya Immobilier, a French real estate company providing property management, rental, sales and co-ownership services.
π¨π¦πͺ ECC Group database containing 52K+ records allegedly leaked by AnkaTeam
β
ECC Group is a Dubai-based group of companies operating across construction, engineering, fit-out, manufacturing, building materials, facilities, and real estate development.
β
An actor using the handle SALDIRGAN, identifying with AnkaTeam, claims to have leaked a database associated with ECC Groupβs official website.
β
Claimed exposed data includes:
β
β’ 52,444 database records
β’ WordPress user accounts
β’ Usernames and display names
β’ Email addresses
β’ Password hashes
β’ User registration dates
β’ Account activation data
β’ Other WordPress database records
β
The actor identifies the backend as MariaDB and the affected CMS as WordPress, describing the incident as a database dump exposure. A sample administrator record was published alongside the claim.
β
The breach claim, record count, and full scope of the exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
ECC Group is a Dubai-based group of companies operating across construction, engineering, fit-out, manufacturing, building materials, facilities, and real estate development.
β
An actor using the handle SALDIRGAN, identifying with AnkaTeam, claims to have leaked a database associated with ECC Groupβs official website.
β
Claimed exposed data includes:
β
β’ 52,444 database records
β’ WordPress user accounts
β’ Usernames and display names
β’ Email addresses
β’ Password hashes
β’ User registration dates
β’ Account activation data
β’ Other WordPress database records
β
The actor identifies the backend as MariaDB and the affected CMS as WordPress, describing the incident as a database dump exposure. A sample administrator record was published alongside the claim.
β
The breach claim, record count, and full scope of the exposed data have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
Media is too big
VIEW IN TELEGRAM
Dangerous apps - In the web of data brokers
What many smartphone users know: the apps on their phones collect detailed location data. What few people know: the information often ends up with a global network of data brokers and advertising companies.
Video Credit: youtube.com/@DWDocumentary
What many smartphone users know: the apps on their phones collect detailed location data. What few people know: the information often ends up with a global network of data brokers and advertising companies.
Video Credit: youtube.com/@DWDocumentary
Forwarded from Dark Web Informer - Private
βΌοΈ DOJ Press Release
βββββββββββββββββββββ
California Man Sentenced to Over 12 Years in Prison for Distributing Sadistic Child Sexual Abuse Material Over the Dark Web
Full Press Release β justice.gov
βββββββββββββββββββββ
π΅οΈ Dark Web Informer β’ DOJ Monitor
Note: DOJ articles that are not Cyber related will be removed manually.
βββββββββββββββββββββ
California Man Sentenced to Over 12 Years in Prison for Distributing Sadistic Child Sexual Abuse Material Over the Dark Web
Full Press Release β justice.gov
βββββββββββββββββββββ
π΅οΈ Dark Web Informer β’ DOJ Monitor
Note: DOJ articles that are not Cyber related will be removed manually.
Department of Justice
California Man Sentenced to Over 12 Years in Prison for Distributing Sadistic Child Sexual Abuse Material Over the Dark Web
James David Johnson, 58, of Santee, California, was sentenced today to 151 months in prison and 10 years of supervised release for distributing images and videos over the dark web that depicted the sexual abuse of children.
β€1
π¨ πͺπΈ Initial Access: Spanish Government Entity
A threat actor is advertising RDP access to an unnamed Spanish government entity with approximately 150 hosts and reported revenue of 20M.
The advertised access includes Local Admin privileges, Dell Unisphere, and several NAS servers containing more than 500TB of data. Kaspersky is reportedly installed but disabled.
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
A threat actor is advertising RDP access to an unnamed Spanish government entity with approximately 150 hosts and reported revenue of 20M.
The advertised access includes Local Admin privileges, Dell Unisphere, and several NAS servers containing more than 500TB of data. Kaspersky is reportedly installed but disabled.
This claim is currently unverified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
π¨ CVE-2026-89094: Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled.
CVSS: 9.9
Foregejo Update/Notes: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.4.md
CVSS: 9.9
Foregejo Update/Notes: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/16.0.4.md
Florida confirms DMV database breach after police account compromised
https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/
https://www.bleepingcomputer.com/news/security/florida-confirms-dmv-database-breached-via-stolen-police-account/
BleepingComputer
Florida confirms DMV database breached via stolen police account
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has confirmed that its DAVID driver database suffered a data breach, saying the attackers gained access using credentials belonging to a police department employee.
πͺ That Dark Web Guy - Part 3 πͺ
I will do top 2 for now. Voting ends sometime in the next 24 hours. Yes I realize the telegram scraper is missing from my Git, I will add it back sometime later today. https://git.darkwebinformer.com
β€3
π¨π²π½ YucatΓ‘n government documents allegedly leaked, 30 GB archive claimed
β
The Government of YucatΓ‘n is the state administration responsible for public services, civil records, education, and other government functions across YucatΓ‘n, Mexico.
β
A forum actor using the handle vansel claims to have obtained approximately 30 GB of documents, totaling around 50,000 files, from the state of YucatΓ‘n.
β
Claimed exposed data includes:
β
β’ CURP identity records
β’ Birth certificates
β’ Official state documents
β’ School-related records
β’ Names and dates of birth
β’ Civil registry information
β’ Family and parental information
β’ Government-issued identifiers
β’ Other personal information contained in official documents
β
The actor states that roughly 10% of the claimed archive has been released so far, consisting of approximately 5,000 PDF files totaling 2.91 GB.
β
Sample documents published with the post appear to include Mexican birth certificates and CURP-related records.
β
The breach claim, source of the documents, total file count, and full scope of the exposure have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing
β
The Government of YucatΓ‘n is the state administration responsible for public services, civil records, education, and other government functions across YucatΓ‘n, Mexico.
β
A forum actor using the handle vansel claims to have obtained approximately 30 GB of documents, totaling around 50,000 files, from the state of YucatΓ‘n.
β
Claimed exposed data includes:
β
β’ CURP identity records
β’ Birth certificates
β’ Official state documents
β’ School-related records
β’ Names and dates of birth
β’ Civil registry information
β’ Family and parental information
β’ Government-issued identifiers
β’ Other personal information contained in official documents
β
The actor states that roughly 10% of the claimed archive has been released so far, consisting of approximately 5,000 PDF files totaling 2.91 GB.
β
Sample documents published with the post appear to include Mexican birth certificates and CURP-related records.
β
The breach claim, source of the documents, total file count, and full scope of the exposure have not been independently verified.
β
π₯ No delays. No guessing. No redactions. Get the intel threat actors see, the moment they post it. darkwebinformer.com/pricing