BRIEFAccess salelowP22
Batch of 130 cPanel/WHMCS root and admin accesses for sale
Detected12 September 2026 · 16:12 UTC
A seller lists 130 cPanel/WHMCS accounts with root, admin or user-level access, which would let buyers seize control of hosted websites and mail. This access type is a classic stepping stone to mass website compromise, credential theft and spam infrastructure. The post appears to date to 2022 and is stale, but affected hosts may still be vulnerable if credentials were never rotated.
CategoryAccess sale
Severitylow
Priority score22
Detected12 September 2026 · 16:12 UTC
Access sale● 35
Venta de exploit RCE 0day para equipos Calix GPONA seller on BreachForums offered a pre-authentication RCE 0day for Calix GPON, hardware widely deployed by fiber ISPs. It could let an attacker take over optical line terminals and disrupt or intercept broadband traffic. The thread dates to March 2025, so treat it as stale vulnerability intel rather than a fresh alert.Access sale● 45
Ministerio del Interior de Camboya (gov.kh): datos a la ventaAn actor is advertising data or access tied to Cambodia's Ministry of Interior (interior.gov.kh), a sensitive law-enforcement ministry. Government ministry access carries high value for espionage and downstream attacks. The details are behind a login wall and the scale and date are unconfirmed, so it warrants verification rather than immediate alarm.Access sale● 55
Venta de acceso a panel de administrador de Vijaysales con 3M de registrosA PwsForums seller is offering 3M+ records plus 'super administrator panel' access to Indian retailer vijaysales.com, dated October 2026. This combines bulk customer data with privileged control of the web platform, enabling further data theft or malicious modification. Retailers using similar e-commerce stacks should review admin access controls and session hygiene.Access sale● 38
Publicación gratuita de accesos root a paneles cPanel/WHMThe actor 'ROOT SYSTEM' published a free 'community drop' of cPanel/WHM root-level access on the DarkNetArmy forum within the last hour, freshly posted today. Even without named victims, bulk root access to hosting panels lets attackers deface sites, deploy phishing, or reach the mail, databases and billing of every account on the affected servers. Because the access is being given away, exposure is likely to spread quickly to low-skilled actors, so hosting providers should hunt for unauthorized cPanel logins now.Access sale● 71
Venta de acceso al portal de la Policía de Rajastán (India)A seller on the BreachForums marketplace is offering material tied to police.rajasthan.gov.in, a state police portal on a .gov.in domain. Law-enforcement portals are high-value targets because they concentrate officer and citizen PII and often serve as a pivot into wider government networks. The listing does not state whether the item is web-shell access, VPN credentials or a database dump, so scope and freshness must be verified before alerting victims.Access sale● 55
Venta de accesos a 7 bases de datos y shell en CanadáA BreachForums actor is selling seven database accesses together with shell access for Canadian targets. Combined database and web-shell access lets an attacker exfiltrate records and maintain persistence once sold. Organizations in Canada should verify exposed systems and rotate credentials.