BRIEFOtherhighP44
Windows 11 local privilege escalation 0day offered for sale
Detected13 September 2026 · 14:12 UTC
A user is selling a claimed Windows 11 local privilege escalation 0day, posted within the last day. If real, it enables post-exploitation elevation on fully patched Windows hosts, raising risk across any Windows estate. Unverified 0day claims on forums are frequently scams or repackaged known bugs, so validate before alerting.
CategoryOther
Severityhigh
Priority score44
Detected13 September 2026 · 14:12 UTC
Other● 38
Publican detalles de explotación de una vulnerabilidad en GenieACSA Cracked.st user (bbxx7) is circulating information on a weakness in GenieACS, the open-source TR-069 auto-configuration server many ISPs use to manage customer routers and CPE at scale. Compromise of an ACS instance can push configuration changes to large subscriber fleets, enabling DNS hijacking, credential capture or mass device reconfiguration. The post is informational rather than an access sale, but telecom operators running exposed GenieACS instances should treat it as an actionable exposure check.Other● 62
Venta de planos de misiles de crucero Tomahawk, JASSM y TaurusA seller using the handle NobawkeyKostao, registered in October 2026 on the Spear marketplace, is advertising cruise-missile and business-jet engine blueprints covering US Tomahawk, JASSM and European Taurus systems. If the material is authentic it represents controlled defence technical data whose circulation would aid reverse engineering and countermeasure development; if fraudulent it is still a lure for defence contractors and procurement staff. Either way it warrants verification and monitoring by military and aerospace supply-chain security teams.Other● 45
PoC público de carga de archivos en el plugin Contact ManagerA working proof-of-concept for an unauthenticated arbitrary file upload in the Contact Manager plugin for WordPress (versions <= 9.1.2) was published today on the SpyHackerz forum. The flaw lets an unauthenticated attacker drop a web shell, which normally leads to full site compromise and hosting of further malware. Because the plugin is widely deployed on small business and public-sector sites, mass scanning is expected within days.Other● 24
Comprador busca documentos de identidad argentinos en BreachForumsA BreachForums user (kBpXuXJUsD) posted a buying request this morning for Argentine identity documents, signaling active demand for stolen DNI/passport data in the local market. There is no sample or named source yet, but such requests typically precede bulk sales of impersonation kits used for bank onboarding and benefit fraud in Argentina. It is worth watching as an early indicator of a circulating Argentine identity-data set rather than a confirmed breach.Other● 44
Exploit php2hell listo para usar contra PHP 5.x–8.5A Niflheim forum post distributes a pre-built 'php2hell' webshell along with details for CVE-2026-109618 and CVE-2026-109619, affecting PHP 5.x through 8.5. PHP underpins a large share of Latin American government and municipal web portals, so a turnkey webshell lowers the bar for mass site compromise and data theft. The CVE references are unverified and should be checked against vendor advisories.Other● 63
Venta de exploit RCE de Chromium para Windows 10/11 (cadena completa)A seller is offering a full Chromium renderer RCE chain affecting Windows 10/11 browsers, posted 21 Oct 2026. Weaponized browser exploits enable drive-by initial access, compromising endpoints without user interaction and bypassing many perimeter controls. Fresh, possibly unpatched browser RCE capabilities are prime enablers of intrusion and ransomware campaigns.