International Cyber Digest

‼️ WhiteDate, the neo-Nazi dating site German Pink Power Ranger hacker "Martha Root" wiped on stage, now forwards to GoebbelSuite, a Google parody built on the AfD leak. goebbelsuite.com

‼️BREAKING: PHP has released its fix for the two leaked flaws, which can let attackers run code on servers without logging in. "There are no complete mitigations, updating is the only safe choice," PHP says. Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now. www.php.net/archive/2026...

PHP says Apache with mod_php is most at risk, with a demonstrated exploit that fires before any application code runs. PHP 8.1 and older get no official update, though PHP has published source backports for 7.4, 8.0 and 8.1.

‼️ UPDATE: DDoSecrets has published the 281GB leak from Germany's far-right AfD for anyone to download. It says the files reveal allegations of embezzlement and financial misconduct. The AfD says hackers copied only parts of a few mailboxes, most unused for years.

International Cyber Digest reposted

‼️BREAKING: The hacker behind the AfD email leak told us they targeted the party to expose what they call its greed and financial misuse. "Hacktivism is often the only answer to populism of this magnitude." "The AFD takes a legitimate frustration and uses it to rob the poorest 20% of this country".

x.comInternational Cyber Digest (@IntCyberDigest) on X‼️ Leaked AfD emails show party bosses approving money for lawyers to stop a story, a "legal way out" pitched to Alice Weidel, a 2,000-name list of "antifascists" and a candidate who bugged a bedroom ...

Read: x.com/IntCyberDige...

"The amount of financial misuse in these documents is appalling, regardless of what you think of immigrants."

‼️UPDATE: Someone offered the hacker behind the AfD email leak €100,000 to take the leak site offline, the hacker told us. An anonymous Proton Mail user wrote "How can we get in touch? We would pay you money to take the site offline." The hacker is keeping the website online.

International Cyber Digest@intcyberdigest.bsky.social

‼️BREAKING: A leak site published 421.179 internal emails from Germany's far-right AfD, including the mailbox of ex-leader Alexander Gauland. ICD found it shows AI-written summaries, not the emails. The newest is from 12 September. Its own index file names a server "afd_exfil".

‼️ DHS political appointees asked CISA to secretly obtain a voting machine and hack it The findings were only to be shared with the White House, and the vendor was not to be told of any flaws CISA employees feared they were being asked to participate in political interference

hexane.cchexane.cc — Document ArchiveAn independent archive of internal documents, correspondence and records, published in the public interest.

Source: hexane.cc

❗️ AI is already killing people. A Russian drone that killed 3 in Zaporizhzhia in July left the strike decision to an Nvidia Jetson Orin chip, Ukrainian investigators say. Nvidia says it is a consumer product sold to students.

THEY SHREDDED MILLIONS OF BOOKS. EVEN THE RARE ONES. THEY DESTROYED OUR HISTORY. TO FEED A MACHINE. A MACHINE THAT ANSWERS ONLY TO THEM. THEY LET IT LOOSE. ON YOU AND ME. MADE THE WORLD THEIR EXPERIMENT. AND THEY NAMED IT SUPERINTELLIGENCE. WAKE THE FUCK UP.

‼️ BREAKING: Trump Mobile customers have had their personal data leaked by ransomware gang BYOD. The dump covers 3,615 people and includes names, emails, phone numbers, home addresses and order details. The gang says the company answered news of the breach with "We have no team to handle this."

t.meInternational Cyber DigestIndependent reporting on cybersecurity, tech, AI & digital policy. Got a tip? http://internationalcyberdigest.com/tips

‼️ We talked to the threat actor behind the Trump Mobile breach, who told us they infected a Liberty Mobile employee with an infostealer, got access to Trump Mobile through it and are still inside its systems. Neither company was using any MFA, allegedly.

Turns out no security team or third-party support is handling the incident right now according to BYOD, "they basically told us to go fuck ourselves" with "no care for customers whatsoever".

The leak includes the Trump Organization's own CIO, who oversees its information security. People listed in the data confirmed their details are accurate and BYOD claims it still has access to Trump Mobile's backend, Straight Arrow News reports.

The Last Supperintelligence Washington, 2026.

International Cyber Digest reposted

❗️ A San Francisco hackathon rejected a former Israeli intelligence Unit 8200 engineer, telling him it didn't want Israel's military to make participants' pagers, phones and laptops "explode in their faces."

Trump refuses to turn his camera on at the G7 summit

Organiser Mostapha Benhenda pointed to the 2024 pager attacks in Lebanon and later told the former Israeli intelligence member Adam Levi there was "no way to know" he wasn't involved.

Jensen Huang called Anthropic compute chief Tom Brown a "bean counter" and threatened to skip his first dinner with Dario Amodei in May 2022 after Brown showed him a spreadsheet arguing Google's TPUs beat Nvidia's chips dollar for dollar.

At the dinner, Huang kept repeating that Nvidia would build the world's biggest data centre, and Amodei muttered that his behaviour was "kind of Trump-like." Source: upcoming book The AGI Chronicles by Kevin Roose

I feel like there's more we need to pace than just the frontier.

The agents escaped the sandbox again Meanwhile the agents' owners:

International Cyber Digest reposted

12 Sept

Ted Cruz spent 9/11 watching porno btw.

blog.faav.netHow I Could’ve Accessed 17 Trillion Microsoft RecordsHow one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.

‼️ BREAKING: A 16-year-old hacker broke into an internal Microsoft analytics service with a forged, unsigned login token and ran SQL as admin, reaching databases that held over 17 trillion rows, including Bing search analytics and 17,990 employee email records.

Faav@faav.net

How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net/how-i-couldv... :)

View full thread

He says he only pulled metadata and two single rows of Bing data, never touched customer data, and reported the flaw to Microsoft the same night.

Microsoft locked the endpoint four days later, paid him $5,000, and had editorial control over his write-up, cutting sections and figures and reshaping how the impact was described before it went public.

blog.faav.netHow I Could’ve Accessed 17 Trillion Microsoft RecordsHow one unchecked login token put 17 trillion rows in a Microsoft internal analytics service within reach.

Faav@faav.net

How I Could've Accessed 17 Trillion Microsoft Records blog.faav.net/how-i-couldv... :)

The service, called Titan, checked every field on the token except its signature, so just claiming to be "admin" got him in, writes the researcher, who goes by Faav.

‼️ Israel is pushing propaganda through YouTube ads being served in Germany, carrying the State emblem and the line "Click to expose the UN's lies." The ads follow "The UN's Lie Industry," a campaign Israel launched recently to influence the policies of US and European capitals toward Israel.

Google says it no longer serves political ads in the EU at all, yet here we are.

16 Sept

‼️ Controversial online casino Duel is selling stolen, unredacted Revolut data in its merch store, packaged as a $29.99 "KYC kit." The data was obtained from threat actors by one of its employees.

16 Sept

Duel is known for provocative rage bait, including glorifying school shooters and Nazis and stereotyping Jewish and Black people. This is a new low. It's unclear which country Duel operates from, but the casino could face a notice-and-takedown (NTD), and even criminal prosecution.

16 Sept

An alleged Duel employee spoke with the threat actors, obtained the stolen KYC data and put it up for sale through Duel.

International Cyber Digest reposted

Hello UK Police, we saw you were looking for these fellas. We found half of them for you. A thread 🧵

Hello UK Police, we saw you were looking for these fellas. We found half of them for you. A thread 🧵

View full thread

The second one has a phone number (ends with 0921) and WhatsApp profile picture publicly available. He's also a Portsmouth FC fan.

The second one from the bottom row sells foreign CBD-infused ice cream, or gelato, as it's better known. Anti-immigrant, apparently, but happy enough to import culture.

Hello UK Police, we saw you were looking for these fellas. We found half of them for you. A thread 🧵

You've already arrested the first one, so he shouldn't be hard to find.

International Cyber Digest reposted