ZeroFox Daily Deep and Dark Web Intelligence - October 23, 2026

ZeroFox Daily Deep and Dark Web Intelligence - October 23, 2026

Product Serial: D-2026-10-23a

TLP:CLEAR

Here is a curated list of critical incidents and compromised data observed on deep and dark web (DDW) ransomware sites, forums, and marketplaces ingested into the ZeroFox Platform in the past 24 hours.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit: https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report for today here

Key Findings

• Ransomware and Digital Extortion: Multiple threat actor groups posted new leak site entries, including Akira Ransomware, Handala Hack Team, Brain Cipher Ransomware, LeakedData, and Everest.
• Vulnerability and Tooling Commercialization: Threat actors on DDW forums XSS and Exploit discussed and shared alleged PHP2Shell exploits for two critical PHP engine vulnerabilities leaked ahead of coordinated disclosure. An untested threat actor on DDW forum DarkForums advertised an alleged Chromium RCE exploit chain targeting Windows 10 and 11.
• Data Dissemination and Telemetry: Threat actors on DDW forums posted several breach and data sale claims, including data sets allegedly associated with the France-based financial software Meria and the France-based finance and investing software Finary, and an auction for a data set purportedly tied to a U.S.-based travel insurance broker.