BRIEFAccess salelowP42
RCE and root SSH access to multiple e-commerce servers offered
multiple e-commerce servers (unnamed)
Detected4 October 2026 · 10:55 UTC
A forum user claims a setup that yields RCE, shells and root SSH access on many e-commerce servers and is looking to monetize it. If credible, these are unpatched footholds sellable for card-skimming or ransomware. E-commerce operators should assume exposed management interfaces are being probed.
CategoryAccess sale
Severitylow
Priority score42
Detected4 October 2026 · 10:55 UTC
Access sale● 58
Venta de acceso a datos/acceso interno de NHS EnglandA VIP seller posted a fresh offering for NHS England, a national health authority, suggesting internal access or data for sale. Healthcare authorities hold highly sensitive patient and operational data, and verified access can be resold to ransomware affiliates. This is a recent post and worth tracking even though the victim is outside LATAM.Access sale● 50
Venta de webshell con acceso al panel de administración de WordPressA seller on the Spear forum, posting within the last hour, is offering a webshell with WordPress administrator panel login. Though no victim is named, such access sales let buyers deface sites, deploy web skimmers or pivot into hosting infrastructure. WordPress admin access should trigger immediate hunting for unauthorized shells.Access sale● 30
Filtración de máquina virtual del exchange español CriptanA leaked virtual machine associated with Criptan, a Spanish cryptocurrency exchange, was posted in a leaked-tools section. Such environments can contain credentials, API keys or customer data. The post dates from January 2026, so it is stale but still relevant for Spanish fintech risk review.Access sale● 35
Venta de acceso a máquina virtual de la exchange DigiFinexA listing offers a virtual machine allegedly belonging to DigiFinex, a global cryptocurrency exchange, dated early 2026. Such a leak could expose exchange infrastructure, API credentials or user data if verified. The post is several months old, so it is not a fresh access sale but may still be useful for tracking reused credentials and crypto-sector targeting.Access sale● 38
Venta de acceso a máquina virtual de la exchange CriptanA forum user is offering a virtual machine reportedly taken from Criptan, a Spanish-regulated cryptocurrency exchange, with a post date in early 2026. If genuine, the image could expose API keys, wallet access or customer data of a financial entity. However the post is months old, so it is not a fresh alert and should be treated as background intelligence for Spanish financial-sector defenders.Access sale● 45
Venta de acceso y base de datos de la Universidad Federal de AkureA seller advertises both access and a database from the Federal University of Technology, Akure (Nigeria). Combining entry access with a student/staff database enables account takeover, credential abuse and further intrusions across the institution's systems. It matters as a live access-sale listing against a named educational target.