DarkFeed: Cyber Threat Intelligence Platform, Tel Aviv (2026)

21/10/2026

🚨 **NEW CYBER EXTORTION GROUP EMERGES: WHITEARMOR ENTERS THE THREAT LANDSCAPE!**

🔴 A newly identified cyber extortion group operating under the name **WHITEARMOR** has surfaced with a dedicated leak platform, revealing its ambitions to expand from data-theft extortion into full-scale ransomware operations.

📢 **What Do We Know About WHITEARMOR?**

The group currently has two public posts on its platform, outlining its operational strategy, recruitment efforts, and claims of upcoming high-profile victims.

🔹 **Data-Theft Extortion:** WHITEARMOR currently focuses on stealing sensitive corporate information and using it for financial extortion.

🔹 **Ransomware Development:** The group claims its ransomware capabilities are nearly complete, signaling plans to expand its operations.

🔹 **Active Recruitment:** WHITEARMOR is seeking experienced pe*******on testers, web exploitation specialists, and zero-day vulnerability researchers.

💰 **An Unusual Revenue-Sharing Model**

The group is offering affiliates an aggressive **95% share of successful ransom payments**, retaining only 5% for itself.

🎯 **High-Profile Organizations in the Crosshairs**

According to the group's own statements, multiple organizations are already being prepared for publication, including Fortune 500 companies and businesses generating billions of dollars in annual revenue.

⚠️ **First Alleged Data Leak**

To demonstrate its capabilities, WHITEARMOR claims to have released an internal staff directory belonging to a globally recognized American entertainment and media corporation.

The group alleges that the information was obtained by exploiting a JWT authentication bypass vulnerability in a gateway system.

It also claims the data was obtained independently of a previously reported incident involving the same organization.

**These claims have not been independently verified.**

🌐 **A New Threat Worth Monitoring**

Although WHITEARMOR is still in its early stages, its recruitment strategy, aggressive affiliate incentives, and claims involving major corporations suggest an ambition to establish itself within the cyber extortion ecosystem.

🔎 **Stay Ahead of Emerging Ransomware Threats with DarkFeed!**

From newly emerging threat actors to established ransomware operations, DarkFeed provides continuous intelligence, victim tracking, and visibility into the evolving cyber extortion landscape.

🌐 **Explore DarkFeed:** https://darkfeed.io

21/10/2026

🚨 **MAJOR UPDATE: PHP Officially Confirms Two Critical Remote Code Ex*****on Vulnerabilities – Emergency Patches Released!**

⚠️ **Following our earlier security alert regarding CVE-2026-109618 and CVE-2026-109619, significant new information has now been officially released by the PHP Security Team.**

What initially emerged as reports of potentially critical vulnerabilities has now been confirmed: **both vulnerabilities can allow unauthenticated remote code ex*****on (RCE) on affected PHP servers.**

🔴 **Both vulnerabilities carry a CRITICAL CVSS score of 9.2/10.**

🌐 **Who Is at Risk?**

According to the official PHP security announcement, the vulnerabilities affect PHP installations serving web requests, including:

🔹 PHP-FPM
🔹 Apache mod_php
🔹 php-cgi
🔹 FrankenPHP
🔹 LiteSpeed

🚨 **Apache mod_php is considered particularly high-risk**, with a demonstrated exploit capable of triggering the attack through an unauthenticated HTTP request, even before application code begins ex*****on.

🔍 **New Technical Details Revealed**

🔴 **CVE-2026-109618 – RCE via Out-of-Memory Corruption**

An out-of-memory condition can interrupt PHP while internal request structures are only partially initialized. Subsequent cleanup operations may incorrectly process invalid data, potentially enabling remote code ex*****on.

🔴 **CVE-2026-109619 – RCE via Stale Global State**

Internal request state may persist after its underlying memory has been freed. Subsequent requests handled by the same PHP worker may access this stale state before proper initialization, potentially allowing attackers to execute malicious code.

🛡️ **OFFICIAL SECURITY PATCHES ARE NOW AVAILABLE!**

Unlike our initial report, where no official fixes had been announced, the PHP Security Team has now released patched versions:

✅ PHP 8.5.12
✅ PHP 8.4.27
✅ PHP 8.3.36
✅ PHP 8.2.35

⚠️ **What About Older PHP Versions?**

PHP 8.1 and earlier are no longer supported by the PHP project. Organizations using these versions should upgrade or check with their Linux distribution or LTS vendor for backported security patches.

The PHP Security Team has also provided limited source-level backports for PHP 7.4, 8.0, and 8.1.

🔐 **What Should Organizations Do Now?**

🔹 Immediately identify PHP installations exposed to web traffic.
🔹 Prioritize patching, especially Apache mod_php environments.
🔹 Upgrade to the latest patched PHP release or install verified vendor security updates.
🔹 Review unsupported PHP installations and plan their migration.
🔹 Apply temporary mitigations where immediate patching is impossible, while recognizing that these do not provide complete protection.

🚨 **Why This Update Matters**

PHP is a fundamental component of web infrastructure worldwide. The confirmation of two critical vulnerabilities capable of unauthenticated remote code ex*****on significantly increases the urgency for organizations relying on PHP-based applications and services.

**The vulnerabilities are now officially confirmed, technical details have been published, and security patches are available. Immediate action is strongly recommended.**

🔎 **Official Security Advisories:**

CVE-2026-109618:
https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w

CVE-2026-109619:
https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp

🌐 Stay informed with DarkFeed: https://darkfeed.io

21/10/2026

🚨 **MAJOR SECURITY ALERT: Two Potentially Critical Remote Code Ex*****on Vulnerabilities Reported in PHP!**

⚠️ Two newly reported vulnerabilities, **CVE-2026-109618 and CVE-2026-109619**, could pose a serious threat to organizations running PHP-based websites, applications, and backend infrastructure worldwide.

🔴 **What makes these vulnerabilities particularly concerning?**

According to preliminary, unverified reports, both vulnerabilities could potentially allow attackers to execute arbitrary code on affected PHP servers, opening the door to server compromise, data theft, and further malicious activity.

🌐 **Potentially Massive Impact**

Initial reports suggest that ALL PHP versions from PHP 5 onward could be affected, potentially exposing a significant portion of the global web infrastructure.

📌 **Current Security Status:**

🔹 CVE-2026-109618 – Reported Remote Code Ex*****on (RCE)
🔹 CVE-2026-109619 – Reported Remote Code Ex*****on (RCE)
🔹 CVSS Score: Not yet assigned
🔹 Confirmed Patches: None announced
🔹 Official Vendor Confirmation: Pending

⚠️ **Why Does This Matter?**

PHP powers countless websites, enterprise applications, and online services worldwide. If these reports are confirmed, the potential attack surface could be enormous.

🛡️ **What Should Security Teams Do?**

Organizations should review their PHP environments, monitor official security advisories, and prepare to deploy updates as soon as verified fixes become available.

**Important:** The reported impact and affected versions have not yet been officially confirmed. Further technical validation is required.

🌐 Stay informed with DarkFeed: https://darkfeed.io

16/10/2026

🚨 **BREAKING CYBER THREAT ALERT | INC Ransom Claims Another High-Profile Victim!**

🔴 The notorious INC Ransom group has added a massive American telecommunications corporation to its list of claimed victims.

The targeted organization is one of the most recognizable names in the global telecommunications industry, headquartered in Dallas, Texas.

📡 **About the Claimed Victim:**
- 🌎 Country: United States
- 🏢 Sector: Telecommunications & Technology
- 💰 Annual Revenue: Over $125 BILLION (2025)
- 🌐 Industry: Mobile communications, broadband, fiber infrastructure, and enterprise connectivity
- 🏆 Profile: One of America's largest and most established telecommunications providers, serving millions of customers.

⚠️ **INC Ransom – A Growing Global Threat**
Active since 2023, INC Ransom has established itself as a major player in the ransomware ecosystem, targeting organizations across multiple industries and countries.

📊 **According to DarkFeed intelligence:**
🔹 900+ claimed victims worldwide since the group began operations.
United States: 500+ victims
United Kingdom: 45+ victims

📢 **Important:** The listing represents a threat actor's claim. The extent of any compromise has not been independently verified.

🌐 For more details, ransomware intelligence, and real-time threat monitoring, visit https://darkfeed.io

06/10/2026

🚨 Everest Ransomware Claims Major UAE Airline as a Victim

The Everest ransomware group has added a major airline based in the United Arab Emirates to its list of claimed victims.

Interestingly, this is the same airline that made international headlines just last week following a serious security incident aboard a flight bound for Israel.

During that incident, the co-pilot allegedly attacked the captain and attempted to crash the aircraft. Passengers and other crew members intervened, and the aircraft was ultimately brought under control and landed safely.

Now, only days after that highly publicized incident, the airline has appeared on the Everest ransomware group’s leak site as a claimed cyberattack victim.

At this stage, the listing represents a claim made by the threat actor, and the extent of any potential compromise or data exposure has not yet been independently confirmed.

DarkFeed is actively monitoring Everest’s activity and this case for additional information, updates, and any potential publication of data.

🔎 Want to stay ahead of ransomware activity?

DarkFeed continuously monitors ransomware groups, leak sites, new victims, and emerging threat actors — giving security teams visibility into the ransomware landscape as it develops.

For additional intelligence and real-time ransomware monitoring, visit:

darkfeed.io

29/09/2026

🚨 New Threat Group Detected: Vladivostok

During DarkFeed’s ongoing monitoring of the cybercrime and ransomware ecosystem, we identified a newly emerging group calling itself “Vladivostok.”

At this stage, the group has not published any victims.

In its introductory post, Vladivostok announced that it is “open for business,” with contact information expected to be published soon.

The group is actively seeking cooperation with researchers, pe*******on testers, and disgruntled employees. According to its announcement, partners could receive a significant percentage of negotiated payments, potentially reaching up to 60% depending on the overall value.

While there are currently no published victims or established operational history associated with the group, its recruitment message suggests an affiliate-style approach and an interest in gaining access through external collaborators and insiders.

DarkFeed will continue monitoring Vladivostok for new infrastructure, victims, operational changes, and further announcements.

🔎 New ransomware groups can emerge without warning. DarkFeed continuously monitors the ransomware ecosystem to help security teams discover new threat actors, victims, and activity as it happens.

Track the ransomware landscape with DarkFeed: darkfeed.io

21/09/2026

🚨 Threat Actor vs. Threat Actor — The Situation Escalates

Yesterday, we reported that ShinyHunters had compromised and defaced the Cl0p ransomware group’s leak site, replacing the content behind Cl0p’s CAPTCHA with a ShinyHunters-branded page.

Now, ShinyHunters has published another update escalating the confrontation.

In a message updated on September 21, the group states that its demands will increase every 24 hours that Cl0p fails to engage with them. The latest demand now reportedly includes a mandatory public apology.

More significantly, ShinyHunters is threatening to disclose information it claims to possess regarding Cl0p’s previous ransomware operations.

According to the message, this could include the identities of companies that allegedly paid Cl0p, the amounts paid, and the Bitcoin addresses to which those payments were allegedly transferred.

ShinyHunters also specifically references what it calls Cl0p’s “EBS campaign,” demanding the money allegedly generated from that operation, together with an additional payment and interest.

The group claims it is prepared to contact major financial media outlets if its demands are not met and has attached a countdown to its ultimatum.

What began as the unusual defacement of another ransomware group’s leak infrastructure is now developing into a public extortion dispute between cybercriminal operations — potentially involving sensitive information about previous ransomware payments.

DarkFeed is actively monitoring the confrontation and any further disclosures or changes to Cl0p’s infrastructure.

19/09/2026

🚨 ShinyHunters Defaces the Cl0p Ransomware Leak Site

This is definitely not something we see every day in the ransomware ecosystem.

DarkFeed is monitoring an unusual development involving two well-known cybercrime operations: ShinyHunters has compromised and defaced the leak site operated by the Cl0p ransomware group.

At the time of our monitoring, visitors passing Cl0p's CAPTCHA are no longer presented with the group's normal leak site. Instead, the site displays a ShinyHunters-branded defacement featuring its recognizable Umbreon imagery.

The incident is particularly notable because ransomware leak sites are a critical part of these groups' extortion infrastructure, used to publish victims, apply pressure and communicate their activities.

ShinyHunters has made additional claims regarding its level of access to Cl0p's infrastructure, but these claims should be treated separately from the visibly confirmed defacement until further evidence becomes available.

Threat actor targeting threat actor — a rare and interesting development in the cybercrime ecosystem.

DarkFeed is actively monitoring the situation for any further changes.

19/08/2026

🚨 Threat Actor Claims Major Payment Platform Breach — Customer Data & API Keys Allegedly Compromised

DarkFeed has identified a newly published post on an underground cybercrime forum claiming a significant breach involving one of the world's largest online payment infrastructure providers.

According to the threat actor's post, the alleged compromise occurred on August 17, 2026, with the actor describing the release as “Part 1” — potentially indicating that additional data may follow.

The actor claims to possess:

🔹 662 compromised databases
🔹 1,033 API keys
🔹 Approximately 33 GB of data
🔹 688,000 unique customer records

The advertised customer dataset allegedly contains fields including email addresses, full names, first/last names, phone numbers, registration dates, and IP addresses.

The presence of allegedly compromised API keys makes this claim particularly noteworthy, as exposed credentials could potentially create risks beyond the disclosure of customer information depending on their validity, permissions, and associated systems.

At this stage, these claims originate from an underground forum post and should be treated as unverified until independently confirmed.

DarkFeed continues to monitor underground forums, ransomware infrastructure, leak sites, and cybercriminal communities for emerging threats before they become widely reported.

🔎 Want visibility into what threat actors are discussing and selling underground? Track emerging threats with DarkFeed:
darkfeed.io

13/08/2026

🚨 ShinyHunters Issues Warning as New High-Profile Victims Appear

ShinyHunters has published a new warning on its leak site, stating that the group is currently experiencing an “influx of volume” and that more leaks are expected to follow.

The message appears primarily directed at organizations currently communicating or negotiating with the threat actors. ShinyHunters warns against delaying negotiations, claims that it holds the leverage, and threatens to immediately publish stolen data when organizations do not cooperate with its demands.

The timing of the message is particularly noteworthy.

Alongside the warning, ShinyHunters has added several high-profile claimed victims spanning healthcare, technology, digital health, and retail/manufacturing.

Among the organizations recently listed are:

🔹 A major privately held U.S. medical device manufacturer headquartered in Indiana, with more than 12,000 employees across its group and medical products distributed in approximately 135 countries.

🔹 A major U.S. global MedTech company providing essential healthcare products, including IV solutions, infusion systems, pharmaceuticals, surgical technologies, patient monitoring and other hospital technologies. Its products are sold across more than 100 countries.

🔹 A widely adopted open-source business intelligence and analytics technology provider. Its platform allows organizations to connect directly to databases, query and visualize information, create dashboards and embed analytics into applications.

🔹 An Atlanta-based digital health company whose technology connects millions of people across the healthcare ecosystem, working with health plans, employers, providers, public-sector organizations and other healthcare stakeholders.

🔹 A well-established American workwear and apparel manufacturer headquartered in Michigan. Founded in 1889, the family-owned company employs thousands of people and has built one of the most recognizable workwear brands in the United States.

The combination of multiple high-profile claimed victims and the group's latest warning may indicate that ShinyHunters is preparing for a broader wave of disclosures.

As always, victim listings and statements published by threat actors should be treated as claims until independently verified.

🔎 Follow ShinyHunters, emerging extortion campaigns, new victims and threat-actor activity in real time with DarkFeed.

darkfeed.io

DarkFeed: Cyber Threat Intelligence Platform

21/10/2026

21/10/2026

21/10/2026

16/10/2026

06/10/2026

29/09/2026

21/09/2026

19/09/2026

19/08/2026

13/08/2026

Address

Website

Alerts

Shortcuts

Share

Category

Listing takedown request