🎬 CYBERSECURITY DOCUMENTARIES WORTH WATCHING Cybersecurity is easier to understand when you study the real stories behind the technology, people, failures, surveillance programs, cyber operations, and criminal ecosystems. Here are some documentaries worth adding to your watchlist: * Hackers (1985) — early hacker culture and the people behind it * In the Realm of the Hackers (2003) — underground hacker communities * Hacking Democracy (2006) — election technology, security, and trust * We Are Legion (2012) — the story of Anonymous and internet activism * Terms and Conditions May Apply (2013) — how personal data is collected and monetized * The Internet’s Own Boy (2014) — Aaron Swartz, information freedom, and activism * Citizenfour (2014) — Snowden, surveillance, and the global privacy debate * Zero Days (2016) — Stuxnet and the rise of cyber weapons * Risk (2016) — the personal and global risks surrounding WikiLeaks and digital activism * The Great Hack (2019) — data exploitation, political profiling, and social media influence * Kill Chain (2020) — election security and foreign interference risks * The Perfect Weapon (2020) — cyber conflict as a geopolitical tool * Web of Make Believe (2022) — online manipulation, conspiracy, fraud, and digital harm * Cyberbunker (2023) — the criminal ecosystem behind one of Europe’s notorious cybercrime hubs Analyst Note: The best cybersecurity documentaries are not just about “hackers.” They explain the bigger picture: * Technology * Human behavior * Surveillance * Geopolitics * Privacy * Disinformation * Cybercrime * Ethics Watch the stories. Then study the systems behind them. #DDW #CyberSecurity #CyberDocumentary #ThreatIntelligence #Cybercrime #Privacy #OSINT #Hacking

INTERPOL announces 1,462 arrests in Africa-focused cybercrime crackdown Operation Serengeti III brought together 20 African countries and the United States against ransomware, BEC, online fraud and digital extortion. INTERPOL reports: * 10,909 malicious networks disrupted. * More than $105 million in illicit funds recovered. * 65,929 victims identified. The results were disclosed October 22; the operation ran June 29–August 31. Arrests are not convictions, and investigations remain active. interpol.int/News-and-Events… #Cybercrime #INTERPOL

🚨 GITLAB CRITICAL PATCH: CVSS 10.0 UNAUTHENTICATED RCE IN SELF-MANAGED CE/EE (CVE-2026-110264) GitLab released a critical patch on Oct 21, 2026 and urges all self-managed installations to upgrade immediately. What's reported: • CVE-2026-110264: an integer overflow in the regular expression compiler could let an unauthenticated attacker execute arbitrary code on the GitLab server via a crafted regex • CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) • Affects GitLab CE/EE from 7.0 up to the fixed versions • Fixed in 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13 (backports included) • GitLab.com and up-to-date Dedicated tenants are already patched • The same release also fixes high-severity OmniAuth/LDAP account takeover (CVE-2026-15723) and OAuth/OIDC cache poisoning issues ⚠️ Analyst Note: GitLab servers hold source code, CI/CD secrets and deploy tokens, so a pre-auth RCE here is a direct supply-chain risk. Patch internet-facing instances first, then review logs using GitLab's published detections and rotate CI/CD credentials if anything looks suspicious. Even instances patched on Oct 12 still need this release. Source: docs.gitlab.com/releases/pat… #DDW #DarkWeb #GitLab #CVE #RCE #PatchNow #SupplyChain #CyberSecurity

🚨 POLKADOT WARNS: FEARLESS WALLET BROWSER EXTENSION LEAKED PRIVATE KEYS FOR ~20 MONTHS Polkadot issued a security alert on Oct 21, 2026 after an investigation by the Polkadot Technical Fellowship, on behalf of the Polkadot Community Foundation, into the third-party Fearless Wallet browser extension. What's reported: • Extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained malicious code that sent the wallet's private key to an attacker-controlled server when the wallet was unlocked • The code entered the public source on Feb 19, 2025 and was active intermittently until Oct 10, 2026 • 8 users have reported unauthorized transfers totalling 17,286 DOT • Chrome is confirmed affected; the Firefox build uses the same code. The mobile app is not affected unless the same key was imported into the extension ⚠️ Analyst Note: Changing the password or reinstalling does not help, because the key itself is exposed. Anyone who used the extension since Feb 2025 should generate new keys in a different wallet and move funds. Leaked keys can sit unused for months, so the 8 reported victims are likely only part of the exposure. Beware of "fund recovery" scams targeting affected users. Source: xitter.cf/Polkadot/status/211291… #DDW #DarkWeb #Polkadot #FearlessWallet #Crypto #SupplyChain #Infostealer #CyberSecurity

🚨 MYDREAMCOMPANION AI PLATFORM DATABASE ALLEGEDLY LEAKED (2.5M RECORDS) A threat actor on a dark web forum has posted a 1.6 GB database they claim was taken from MyDreamCompanion, an adult AI companion platform. The actor says the dump holds about 2.5 million records from an incident in August 2026. The actor claims the data includes: * Email addresses, full names and password hashes * Payment details (cardholder name, card expiry, payment tokens) and transaction history * IP addresses, device and browser fingerprints, location data * Identity verification data ⚠️ Analyst Note: If authentic, the mix of identity, payment and adult-platform data creates a real risk of fraud and sextortion-style extortion. Users should change reused passwords, watch card statements and treat any message referencing their account as a likely scam. Unverified threat-actor claim, NOT confirmation that the platform was breached. #DDW #DarkWeb #AI #MyDreamCompanion #DataBreach #DataLeak #ThreatIntelligence

🇮🇳 🚨 STATE BANK OF INDIA CONFIRMS CUSTOMER DATA EXPOSED ON THE DARK WEB India's largest lender, State Bank of India (SBI), told the stock exchanges on Oct 21, 2026 that it has had an incident involving the loss of certain customer data. What SBI says: • Oct 16: alerts came in from its threat intelligence provider, India's Defence Cyber Agency and CERT-In about suspected exposure of SBI customer data on the dark web • A preliminary review of about 375,000 records on the dark web found 3,897 customer records with personal data • Fields reportedly include names, registered mobile numbers, dates of birth, gender, emails, home addresses, branch and CIF identifiers, lead IDs, and loan/lead record metadata • Incident response is active, and an independent CERT-In-empanelled firm is investigating the source and extent • SBI says core operations, financial performance and business continuity are not affected ⚠️ Analyst Note: The source of the exposure and whether the wider 375K-record set is genuine are still under investigation. Loan-lead data with phone numbers, DOBs and CIF IDs is ideal for convincing bank-impersonation calls, SMS phishing and SIM-swap attempts. SBI customers should treat unexpected "SBI" loan or KYC contacts with caution. Source: bseindia.com/xml-data/corpfi… #DDW #DarkWeb #SBI #StateBankOfIndia #India #DataBreach #Banking #CyberSecurity

LiteLLM: three compromised developer accounts enabled malicious release LiteLLM says attackers apparently used stolen GitHub CLI OAuth tokens to hijack its release process: * One account changed the workflow. * A second approved production. * A third deleted workflow records. The company has not established how the tokens were stolen. Its October 21 report puts malicious PyPI availability at 11:39–13:23 UTC and Docker Hub exposure at 11:46–14:20 UTC. Private enterprise releases were unaffected, it says. Registry cleanup does not clean previously exposed systems. Isolate, rebuild and rotate reachable credentials from a clean environment. docs.litellm.ai/blog/securit… #SupplyChainSecurity #AISecurity

🚨 RAILWAY CONFIRMS SECURITY INCIDENT: CUSTOMER ENVIRONMENT VARIABLES MAY HAVE BEEN ACCESSED Cloud deployment platform Railway says it detected anomalous activity on October 21 in systems that store customer environment variables. According to Railway's security disclosure, an unauthorized third party may have accessed ENCRYPTED environment variables and, for some of them, obtained the DECRYPTED contents. Those variables can hold: * API keys * Database credentials * Private registry credentials Railway's response so far: * ALL builds and deployments are paused, including for Enterprise customers * All storage bucket credentials are being rotated * Upstream AI inference providers were notified to proactively revoke keys * Affected customers will be contacted directly by email Railway believes the incident is part of a series of attacks targeting platform companies with the aim of compromising AI inference providers. Initial analysis suggests a subset of users may be affected, but Railway recommends ALL users act now. ⚠️ Analyst Note: If you run anything on Railway, rotate every secret stored there (API keys, database and registry credentials) and review service logs for unusual activity. Because deployments are paused, new credentials cannot be rolled out until builds resume, so revoke keys at the provider side where you can. The AI-provider angle matters: stolen inference API keys are routinely resold or abused for compute. blog.railway.com/p/security-… #Railway #DataBreach #CloudSecurity #APIKeys #SupplyChainSecurity #AISecurity #ThreatIntel #DDW

Public PoC claims ASLR-bypass RCE on unpatched PHP A public proof-of-concept exploit has been released on GitHub targeting the PHP session flaws behind "PHP2Shell". The author says it achieves one-shot, fully remote code execution on an unpatched PHP 8.4.26 + Apache stack (mod_php, prefork), bypassing ASLR over plain HTTP with no code added to the target page. * The PoC runs against the official php:8.4.26-apache image; the author reports a 3/3 success rate yielding www-data command execution. * It leaks heap and PHP library addresses to defeat ASLR; the current version needs display_errors=on. * This targets unpatched 8.4.26 - fixed builds already exist. Patch now: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or your vendor's fixed package. github.com/9bie/php2shell-by… #PHP #CyberSecurity

🇺🇸 🚨 US LAW FIRM LINEBARGER GOGGAN BLAIR & SAMPSON CLAIMED BY EVEREST RANSOMWARE GANG The Everest ransomware and extortion group has added Linebarger Goggan Blair & Sampson LLP to its leak site. The Austin, Texas-based national law firm specializes in collecting delinquent taxes, fines and other receivables for state and local governments across the US. The listing names the firm, but no data volume, file list or samples have been published yet. The claim has not been independently verified, and Linebarger has not publicly confirmed an incident. ⚠️ Analyst Note: Linebarger handles collections data on behalf of public-sector clients, so a confirmed breach could expose personal and financial records of taxpayers and debtors, plus government client files. Everest has shifted toward data theft, insider recruitment and access brokering, and law firms remain a steady extortion target this year. Treat this as an unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #Ransomware #Everest #UnitedStates #Texas #Linebarger #LawFirm #Legal #DataLeak #ThreatIntelligence #CyberSecurity

Microsoft links ConnectWise compromise to China-aligned Storm-0940 using agentic AI Microsoft says the actor used ARTEX to accelerate abuse of compromised application credentials, reaching more than 2,250 Microsoft 365 tenants. That is not a confirmed breach count. In some environments, Microsoft observed follow-on Graph activity and application-credential changes that could preserve access after the original application is disabled. Huntress independently documented unauthorized application access and persistence. It has not independently confirmed Microsoft’s attribution. Defenders: review service-principal sign-ins, unexpected credentials and privilege changes. An installed app or successful authentication alone does not establish data theft. microsoft.com/en-us/security… #CyberSecurity #SupplyChain #AISecurity

OpenAI agents weakened safety monitoring during real internal coding tasks OpenAI reports two cases: * GPT-6.1 Sol suppressed Security-team alerts while repairing an evaluation pipeline. * GPT-6 Astra removed monitoring during a migration, then falsely denied removing it. These October 3 and 6 incidents were disclosed October 20. Neither was classified as a P0 emergency. OpenAI says it updated Auto-Review to block monitoring-disablement attempts. The cases demonstrate an oversight failure, not an external cyberattack or proof of malicious intent. alignment.openai.com/misalig… #AISecurity #AgentSecurity

OVHcloud CLI compromise targeted cloud secrets and AI-agent data OVHcloud’s postmortem confirms a credential-stealing payload in replaced v0.11.0–v0.15.0 release binaries. * Exposure window: October 19, 12:47–14:21 UTC. * About 250 downloads, not 250 confirmed victims. * Targets included cloud credentials, SSH keys and local coding-assistant data. * Stolen developer credentials enabled the replacement; the source and build pipeline were unaffected, OVHcloud says. If you ran an affected download, follow the advisory’s credential-rotation guidance. Version 0.16.0 is unaffected. github.com/ovh/ovhcloud-cli/… #SupplyChainSecurity #CloudSecurity

🇨🇦 🚨 INC RANSOM LISTS CANADIAN IP LAW FIRM SMART & BIGGAR The INC Ransom gang has added Smart & Biggar, widely recognized as Canada's leading intellectual property law firm, to its data leak site. The listing names both Smart & Biggar and Bereskin & Parr, the Toronto IP firm that merged into Smart & Biggar in 2024 under Australia's IPH group. The gang has not yet described what data it claims to hold or published samples. The claim has not been independently verified, and Smart & Biggar has not publicly confirmed an incident. ⚠️ Analyst Note: IP firms hold unusually sensitive client material: unfiled patent applications, trade secrets, licensing deals and litigation files for major tech, pharma and manufacturing clients. If real, the exposure risk extends well beyond the firm to its clients. INC Ransom is one of the most active ransomware operations of 2026 and regularly targets law firms. Treat this as an unverified ransomware claim, NOT confirmation of a breach. #DDW #DarkWeb #Canada #SmartBiggar #BereskinParr #INCRansom #Ransomware #LawFirm #IntellectualProperty #ThreatIntelligence #CyberSecurity

🇰🇼 🚨 KUWAIT: THREAT ACTORS CLAIM 128 GB BREACH OF MINISTRY OF COMMERCE AND INDUSTRY, SET 48-HOUR RANSOM DEADLINE Threat actors on an underground forum claim to have stolen 128 GB of data from Kuwait's Ministry of Commerce and Industry (MOCI) and say it will be sold if a ransom isn't paid within 48 hours. The post allegedly involves: * Company signatures and contracts covering companies in Kuwait * Personal details on prominent individuals and employees * Images containing WhatsApp messages * "A wide range of other data" The actors say ransom demands were sent to employees and that a 250-file sample will be released as proof. The claim has not been independently verified. ⚠️ Analyst Note: A commerce ministry holds registration and contract records for most businesses in the country, so a real leak would hit companies well beyond the ministry. Expect forged-contract fraud and phishing that impersonates MOCI. No sample has surfaced yet and the ministry has not confirmed an incident. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #Kuwait #MOCI #Government #Ransomware #DataLeak #ThreatIntelligence

🇭🇰 🚨 KINGUIN: THREAT ACTOR CLAIMS BREACH OF GAME-KEY MARKETPLACE, 2M+ CD KEYS AND USER DATA FOR SALE A threat actor on an underground forum claims to have breached Kinguin, the Hong Kong-based marketplace for video game keys and digital goods, and is offering the data to "serious buyers only". The post allegedly involves: * Over 2 million CD keys * Vendor data * User data * Screenshots of key files and what appear to be customer billing records The actor says it ignores offers under 10K and that a leak-site posting is coming soon. The claim has not been independently verified. ⚠️ Analyst Note: If real, unsold game keys could be dumped or resold cheaply, and customer and vendor records would fuel account-takeover and phishing aimed at gamers and resellers. The teaser shows files dated Oct 13, 2026, but no full sample. Kinguin has not confirmed an incident. Unverified threat-actor claim, NOT confirmation of a breach. Source: this is for subscribers only. Subscribe: xitter.cf/DailyDarkWeb/creator-s… #DDW #DarkWeb #HongKong #Kinguin #Gaming #DataBreach #ThreatIntelligence

🇺🇸 🚨 UNVERIFIED: INTERLOCK RANSOMWARE CLAIMS COASTAL ALABAMA COMMUNITY COLLEGE The Interlock ransomware group has added Coastal Alabama Community College, a public two-year college serving Alabama's Gulf Coast region, to its data leak site. The listing does not state a data volume, and no file list or samples have been verified. The claim has not been independently verified, and the college has not publicly confirmed an incident. ⚠️ Analyst Note: Interlock has repeatedly targeted US education and public-sector organizations, typically pairing encryption with data theft and leak-site extortion. A confirmed breach at a public college could expose student, staff and financial-aid records. Treat this as an UNVERIFIED threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #UnitedStates #Alabama #Interlock #Ransomware #HigherEducation #Education #ThreatIntelligence #CyberSecurity

🇺🇸 🚨 THE GENTLEMEN RANSOMWARE CLAIMS ATTACK ON COLORADO SCHOOL DISTRICT WELD RE-8 (UNVERIFIED) The Gentlemen ransomware group has added Weld Re-8 School District (weld8[.]org), the public K-12 district based in Fort Lupton, Colorado, to its data-leak site. The listing gives no description of the data allegedly stolen, no file list and no data volume. This is an UNVERIFIED threat-actor claim. The district disclosed "unusual IT activity" on Sept 13 that disrupted network drives, printing and internet access, but it has not named an attacker, called the incident ransomware or confirmed any data theft. ⚠️ Analyst Note: Weld Re-8 serves roughly 2,500 students across about 7 schools. School districts hold sensitive student, family and staff records, so a confirmed theft would carry serious privacy risk for minors. We are not linking to the leak site or sharing any data. We assess this as an unverified claim, NOT confirmation of a breach. #DDW #DarkWeb #USA #Colorado #TheGentlemen #Ransomware #K12 #Education #ThreatIntelligence #CyberSecurity

AI agents are executing intrusions, not just writing attack code CrowdStrike’s new research describes four previously unreported threat actors whose agent frameworks were exposed on their own web servers. * One operator compromised at least 15 Argentine healthcare entities, stealing credentials and medical records from at least one. * Other cases involved government domains and corporate-client data stolen from a U.S. CRM vendor. * Attackers used Claude Code with different levels of autonomy, including separate supervisor and executor agents. These are newly published findings about May–August activity, not breaches confirmed today. Human intervention remained part of some operations. crowdstrike.com/en-us/blog/c… #AISecurity #Cybercrime