Anything that you are finding via reddit search or get in a reddit chat/message/comment/reply is a scam designed to phish you and steal your crypto.

Today, a new search utility has been implemented onto VormWeb's search mechanism, making it possible to obscure your search experience, which is Darkobfuskator.

With Darkobfuskator, users can now switch between three modes to either hide searched keywords from the URL and browser tab ("Moderate" mode), or to have that & hide VormWeb's search UI entirely within the layouts of popular Clearnet websites ("Extended" mode)¹, all without leaving VormWeb!

While the former brings a technical advantage for users on the Clearnet mirror who wish not to give their ISP or Tor exit node information about their search, the latter can be useful for special occasions, such as being outside or in a situation where privacy is limited due to surroundings. Surely, even if that is not always the case, Darkobfuskator's existence will be helpful in a moment when it's really needed.

The "standard" mode is active by default and does nothing of the two above, so it is just like before.

Moreover, there have been more minor changes and improvements, such as the introduction of a Javascript indicator as well as informational help boxes in the search to give users awareness of JS being activated in their browser and a quick introduction to VormWeb.

Use it today, use it tomorrow - use VormWeb:

* Clearnet: https://vormweb.de/en

* Darknet: http://volkancfgpi4c7ghph6id2t7vcntenuly66qjt6oedwtjmyj4tkk5oqd.onion/en

¹: Those layouts are not functioning copies of the websites as they're acting as a dummy. Disclaimers about a layout's owner are given on the bottom of every site, however, in such way that lurkers who are physically around the site visitor do not notice it.

Resolving and browsing .onion hidden services on mobile devices has historically been awkward on iOS, often relying on third-party proxies, SOCKS configuration profiles, or opaque bundled browsers.

As part of the StealthOS project (a sandboxed privacy operating environment for iOS), we built native support for .onion v3 hidden services directly into the app address bar and network stack.

How it Works Under the Hood

1. Native On-Device Tor Daemon: Rather than using remote proxy endpoints or cloud bridges, StealthOS compiles and executes the Tor client locally as an in-process daemon. We open-sourced the reproducible build wrapper at https://github.com/Olib-AI/TorClient (compiles the upstream C Tor source into a static iOS library with byte-for-byte reproducibility).
2. Deterministic DNS and .onion Routing: When a user navigates to an address ending in .onion, the internal URL scheme handler and WKURLSchemeHandler pipeline intercepts the request before it touches the OS default network interfaces, routing DNS resolution and TCP streams strictly through the local SOCKS/Control port of the embedded Tor daemon.
3. Fail-Closed Leak Switch: If circuit negotiation drops, circuits fail to rebuild, or the daemon encounters an error, the networking pipeline terminates immediately rather than leaking the hostname or IP over standard cellular or Wi-Fi interfaces.
4. Isolated Sandboxing: Each session runs in isolated memory with state cleared upon exit or duress password trigger.

Links

• App Store: https://apps.apple.com/us/app/stealthos/id6756983634
• Project Details: https://www.stealthos.app
• TorClient Build Repo: https://github.com/Olib-AI/TorClient

We would love to hear thoughts from other hidden service operators and Tor users on mobile threat models, circuit management under aggressive iOS background execution limits, and .onion browsing UX.

Auto install via sudo apt or flatpak into persistent storage

User dats is another story. Im just starting with synaptic/apt but if i can get flatpak running & saving in persistent I can figure out how to go from there.

I understand what the run on tails app persistence scripts do but having difficulty on a clear way to standardize it and do simplex, sessions, and a few other so I can just launch apps as needed & not reinstall via flatpak temporarily or running an app image.

I did see ee a extract & run script but I dont see it install in the system & seems to run straight from terminal.

Combining methods in all 3 types eould help but I gotta wrap my head on also dping the .config/applications & .local/share or the root.d & amnesia.f folders for tails autostart.

PHP2Shell Security Alert: Exploitation Attempts Began Before Public Disclosure

Updated: October 23, 2026 | Severity: Critical

Two critical vulnerabilities in PHP, the programming language used by many websites, could allow attackers to execute malicious code on vulnerable servers without logging in.

The vulnerabilities are:

CVE-2026-109618 — Memory corruption during out-of-memory handling.

CVE-2026-109619 — Improper handling of internal request state.

Both carry a CVSS v4.0 severity score of 9.2 (Critical).

These vulnerabilities are collectively known as PHP2Shell.

New Findings: Attacks Started October 17

On October 21, Amazon Threat Intelligence reported detecting an attempted PHP2Shell exploit dating back to October 17, 2026, four days before the vulnerabilities were publicly disclosed.

Amazon's MadPot honeypot network recorded additional exploitation attempts on October 21, including activity originating from anonymization services.

Following public disclosure, researchers observed widespread attempts to exploit vulnerable systems.

Important distinction:

Confirmed: Researchers observed real exploitation attempts.

Not confirmed: Those early attempts successfully compromised production servers.

How the attacker obtained exploit information before public disclosure is unknown.

Amazon cautions that the effectiveness of the early attempts against real-world systems remains unclear.

Could Onion Services Be Affected?

Yes. Onion services running vulnerable PHP installations could potentially be affected.

Tor helps conceal a server's network location, but it does not protect against vulnerabilities in the website software.

A successful compromise could allow attackers to access application data, modify website content, or execute code with the permissions of the PHP service.

Depending on the server's configuration, this could also threaten its anonymity.

However, there is no evidence in this advisory that a specific onion service has been compromised through PHP2Shell.

What Administrators Should Do

.Update PHP Immediately

Install the appropriate fixed version:

PHP branchFixed versionPHP 8.58.5.12PHP 8.48.4.27PHP 8.38.3.36PHP 8.28.2.35

Administrators using older PHP versions should upgrade to a supported release or obtain a verified security backport from their distribution vendor.

After updating:

Restart affected PHP workers and web services.

Verify the PHP version used by the website, not just the command-line version.

Check containers and other applications that may bundle PHP.

Confirm the website still functions correctly.

Aside from using Ahmia or accessing onion links, do y'all use TOR for a different purpose? like idk watching videos for example, is there anyone who doesn't use TOR for daily mondane activities?

I'm just posting for no reason cuz I'm bored

Researchers published a paper titled On the Effectiveness of NetFlow-Based Deanonymization of Tor Onion Services.

Their research demonstrates that attackers with access to certain network traffic records may be able to identify the network location of an onion service.

The researchers investigated three techniques, including one that exploits information exposed by Tor's proof-of-work denial-of-service defenses.

The concerning discovery: Some attacks worked using relatively coarse network measurements rather than detailed packet captures.

The researchers evaluated their techniques using data from the live Tor network.

Tor encrypts traffic and conceals network locations, but traffic analysis remains a potential weakness.

An attacker who can correlate traffic patterns may infer information without decrypting the underlying communications.

This research concerns onion-service anonymity. It does not establish that ordinary Tor Browser users can be routinely identified.

GoBalance Vulnerability Independently Analyzed — Dread Wasn't the Only Service Affected

Researchers at Searchlight Cyber published a detailed technical investigation into the GoBalance vulnerability connected to the recent Dread onion-address hijackings.

Their findings substantially strengthen the technical explanation previously attributed to Dread administrator Paris.

The researchers identified a specific cryptographic implementation error.

GoBalance incorrectly handles Tor-format Ed25519 private keys during descriptor signing, discarding secret material needed to generate unpredictable signatures.

An attacker can potentially recover an affected onion service's long-term signing secret from publicly available descriptor information.This does not require access to the service's actual servers.

The researchers also established an important distinction: the vulnerability affects GoBalance's handling of certain Tor-format keys, not the original Onionbalance implementation or Tor itself.

A separate researcher has published a proof of concept, although an official GoBalance fix was not available in the reporting reviewed on October 9.

Independent technical analysis supports the vulnerability. The precise circumstances of each reported hijacking and claims about stolen user databases remain unverified.

An attacker recovering an onion service's master signing secret can impersonate that address even if the legitimate service's servers remain secure.

Simply patching the vulnerable software does not make an already exposed identity key trustworthy again.

Affected operators need fresh identity keys and authenticated migration announcements.

whadefok bradar what is this

Is dread's third site down too? Or is it just... a regional thing?

Hello, I came here today because I have a few questions.

This may be a sudden question, but is Dread currently inaccessible?

I heard that its private key was leaked and abused by a third party, causing the old link to go offline. However, I can't access Dread through the forum I normally use. When I looked at other sites, some said the link was online, while others said it was offline, and some even said that the link was dead. I'm really confused about what is actually happening.

Could someone please explain what is going on?

I also came across this forum site while looking for a Dread link:

https://dread-forums.ne t/

The site also provides a Dread link. I'm not sure whether either of them is genuine, and personally, I find the site somewhat suspicious, so I came here to ask about it.

Even though I was already somewhat suspicious, I followed the link to Dread. The login page looked strange, and no matter whether I clicked Messages or Profile, I was always redirected back to the Home page. I also couldn't post any comments.

Unfortunately, I already tried logging in several times...

Is this forum site potentially dangerous, or is it actually legitimate?

If anyone knows more about this situation, I'd appreciate it if you could let me know.

I was logging in all day np. I refresh after a few hrs & it's conclave again.

Idm how deep this goes but we had a community & without hacing names & pgp for everyone and continuing ongoing ads/promos will be a fuckin PITA for tons of users & business ppl.

MF man.MF

Just curious, had a "friend" say its very common

i accessed it yesterday and apparently this happened several days ago so i'm scratching my head.

I've recently discovered this thread and have been seeing people mention dread network or something. I'm just curious, what's that?

Has anyone here been caught not from a technological standpoint or having a package intercepted, but just from running your mouth? Most people don’t believe me when I talk about how I ran my mouth about the oil I had back when I was 18 and people made noise to the point that I had a certain three-letter agency open an investigation into me, spanning over the course of two years.

The free Tor browser VPN used to hide my location, allowing me to access content unavailable in my country. I always use the Tor browser itself for this also.

However, since updating my iPhone, I have been blocked from this content even while the VPN is in effect, and my IP address has been changed. I have used data instead of WiFi and disabled location services, yet this issue persists.

Are there any solutions or VPNs which function to change this?

I’ve been interested in the dark web for a while—more for its atmosphere and culture than for the things usually associated with it (illegal marketplaces, etc.). I’ve just installed Tor and would like to do some real exploring, but while staying strictly within legal and safe boundaries.

What I’m looking for: .onion sites with a dark or mysterious aesthetic, but nothing illegal or dangerous—for example, digital libraries on esotericism or exorcism, showcases of "cursed" objects or oddities (just for viewing, not buying), archives, folklore, or things that are a bit gothic or offbeat.

If you have any reliable addresses or up-to-date directories to recommend (like Ahmia or others), I’d love to hear them. Thanks in advance!

I'm trying to buy stuff,

found a vendor that has good reputation, tried to purchase,

while trying to encrypt my message I noticed that the user IDs are revoked (but not the key itself)

what does that mean ?

should I worry ?

I am a teen and have been looking at ways to protect against government surveillance and just privacy from companies alike, any thoughts or suggestions?

Trying to access DH on Ornet app and just get this every time tired of this being the only site i can’t get into