short notes about this list, the tor network and not getting phished. no newsletter, no comments, no rss bloat - it updates when it updates.
A joint operation by North Macedonia's cybercrime unit and the FBI has led to the arrest of a 20-year-old alleged operator of the OLVX cybercrime marketplace, which reportedly generated more than $500,000 in illicit sales of stolen data and login credentials. Investigators also examined evidence tied to his Telegram activity, including a refund-fraud group he allegedly ran.
PHP shipped out-of-band releases today for two critical use-after-free bugs enabling unauthenticated remote code execution. Sites running PHP - especially onion services - should update and restart all workers now.
The blockchain-analytics firm says an external actor used AI-driven “offensive agentic techniques” to access its systems and internal tools, exposing user IDs, names, email addresses and role labels. Investigation content and credentials were not accessed, according to the company.
A malicious script injected through a compromised third-party vendor hit Polymarket's front end and drained an estimated $2.7 million from about 700 users, according to Bubblemaps monitoring. Trading has resumed, the company has promised full reimbursement, and it is the platform's second vendor-origin compromise in 2026.
The European Parliament failed to block the revival of the EU's temporary voluntary message-scanning regime on July 9, 2026 - 314 MEPs opposed it, but the absolute-majority threshold was never reached. With the permanent CSAR talks resuming in September, the fight over scanning and encryption directly shapes the future of anonymity tools.
Slovak intelligence dismantled an EU-funded NERO R-ONE camera and found a rebadged Russian CORDON PRO.M with two modems and a hidden SMS-triggered backdoor tied to twelve Russian phone numbers.
A single actor behind the CameraSwarm campaign compromised at least 14,530 Dahua IP cameras across Ukrainian, Russian and CIS networks in 35 days, leaning heavily on the 2021 authentication bypasses CVE-2021-33044 and CVE-2021-33045. The operation only came to light because the attacker left his own toolkit exposed online.
LockBit 5.0 threatens to publish identity documents tied to more than 100,000 job candidates from French staffing group Actua, spread across ten storage locations at once. What the claim-versus-reality gap looks like, and why scattered leaks change the takedown math.
Telegram has applied to ICANN for the .gram top-level domain, turning usernames into resolvable domains with AI-generated sites behind them. Coming weeks after t.me was suspended under sanctions pressure, the move highlights how infrastructure is drifting away from onion services toward DNS that regulators can actually touch.
A hacker using the alias ZeroBytes advertised a stolen DGFiP database on PwnForums, claiming live access to French tax systems. France's economy ministry confirmed illegitimate access affecting about 678,000 individuals and organizations; the seller's larger claims remain unverified.
The FortiBleed leak exposed admin credentials for tens of thousands of internet-facing FortiGates across 194 countries. Within days of CISA's emergency advisory, an initial access broker was selling bulk US device accesses on Darkforums with forum escrow.
After Abacus went offline in July 2025 amid withdrawal failures and exit-scam suspicions, its buyers scattered toward Torzon and Black Ops Market - while newer platforms rebuilt the payment stack around built-in coin swapping.
