SoylentNews

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn't find among Switzerland2's authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Ultimately, 333 exit relays were involved in the SSH and email interception campaign, although investigators haven't established how the attackers gained control of all the underlying servers. The attackers then reconfigured the servers. One set of changes redirected SSH traffic traversing Tor to one of 12 attacker-controlled interceptor servers. Tor users who ignored warnings that the SSH host key had changed would then enter their SSH passwords.

A second set of changes caused the exit nodes to block ports 25, 465, 587, 993 and 995—used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections, the attackers used their access to the exit nodes to obtain unencrypted messages. It's unclear whether any such downgrade attempts succeeded. The hijacking occurred from October 2 to October 5.

Tor volunteers partially outlined the initial compromise of the management server and Switzerland2 and the attempt to intercept unencrypted email. Tuesday's report revealed many new details, including how many exit nodes were compromised and how the attackers used them to redirect SSH traffic.

"If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won't notice anything at first," Kaba, the name of the Tor volunteer who authored the post, wrote. "Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you're unknowingly redirected to one of 12 SSH interception servers. That's exactly what happened to me on Friday morning." Kaba then received the following warning:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
Please contact your system administrator.

The volunteer investigated further and found that when people ignored the warning, the attacker (1) stole the SSH password, (2) opened a connection to the server and observed all typed commands, and (3) opened a second connection and infected the server with Ebury.

To investigate the campaign, Kaba created a script that polled all of Tor's roughly 3,000 exit nodes to check whether they received a correct SSH fingerprint from a test server. The test server then checked whether the connection came from a pinned exit node or one of 12 SSH interception servers used by the attacker. The volunteer further set up a honeypot to observe the interception software attempting to log in and install Ebury.

Several mysteries remain. Tor volunteers still don't know how the attackers accessed so many servers. One possibility is that a company hosting them was hacked, but the theory is inconclusive. Another open question is who is behind the attack. "The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group," Kaba wrote. "Though this too is just speculation."

A last perplexing finding: why did Switzerland2 accept an RSA key when there's no evidence it was an authorized SSH certificate?

The takeaway from the event is the crucial role defense in depth plays in preventing data theft in mass hacks like this one. Those measures include configuring email accounts to accept only encrypted traffic and reject unencrypted ports. Another is to disable password authentication in favor of SSH keys.

Source BBC Television News: (17:18 BST Sep 2026)

The Prime Minister has stated that the UK now believe that Iran was behind to the attempted attack on RAF Fairford.

The Iranian Ambassador has strongly denied any connection with the incident.

See previous reporting: https://soylentnews.org/article.pl?sid=26/09/28/1259254 https://soylentnews.org/article.pl?sid=26/09/27/115249

Source: BBC News: 07:18 BST 02 Oct 2026

The police have confirmed the arrest of a dual nationality (UK/Iran) man in the London area, linked to the incident at RAF Fairford on Sunday.

Source: BBC Television.

The UK Police have announced that all 5 men arrested in connection with the suspected terrorist attack attempt at RAF Fairford are UK nationals in their 20s from the London area.

For previous reporting see: https://soylentnews.org/breakingnews/article.pl?sid=26/09/27/115249

The Head of Counter Terrorism Police (CTP) has given an public announcement at 15:45 BST:

The 5 individuals who have been arrested are being released on police bail with significant restrictions on who they may contact, on reporting regularly and movement. They remain under investigation.

They are currently being released while remaining under charges relating to the Police and Criminal Evidence Act (PACE). No mention was made relating to earlier charges.

The CTP have numerous new leads that they are following. They are keeping an open mind about who might ultimately be behind the attempt. They stress that it must be remembered that individuals may be used as proxies without necessarily knowing who is directing the attempt, or even knowing that they were being manipulated.

The alert states at both Fairford and Lakenheath remain as previously announced.

The Head of CTP stated that the alert was raised by 2 phone calls made by civilians. Nothing was said about any prior intelligence.

The latest statement by the CTP (19:25BST 29 Sep 2026):

No explosives were found in the vehicles used by the 5 men arrested near RAF Fairford. A quantity of vehicle fuel was found. Searches of the homes of the 5 men have not revealed anything significant to the investigation.

Without any further evidence the individuals were released on bail. The decision was based on insufficient evidence to justify holding the 5 offenders longer although they could always be re-arrested if it is subsequently justified, and 'strategic' considerations. The investigation is continuing with close liaison between the relevant security agencies in the UK, and with the US.

Source: BBC (07:01BST 30 Sep 2026)

One of the 5 men arrested in connection with the incident near RAF Fairford had phoned the police (999) himself.

The Prime Minister has stated that the UK now believe that Iran was linked to the attempted attack on RAF Fairford.

The Iranian Ambassador has strongly denied any connection with the incident.

https://edition.cnn.com/2026/09/27/uk/fairford-arrests-uk-raf-us-intl

UK counter-terrorism police are leading an investigation after several men were arrested on suspicion of explosives offenses near an air base used by US forces.

A number of properties were evacuated in the Whelford area in the county of Gloucestershire "following the declaration of a major incident," a police statement said.

"The Army's specialist explosive ordnance disposal team are currently examining a number of vehicles," the statement said

Whelford is close to the Royal Air Force base at Fairford which has been used by US B-1 bombers involved in targeting Iran and is a forward operating location for US Global Strike Command, which is tasked with managing long-distance strikes.

A US air force spokesperson at Fairford - where the 501st ​Combat Support Wing is based - told CNN: "For operational security reasons we will not discuss specific force protection measures."

The unit "remains vigilant and will take appropriate actions to ensure the safety and security of our US service ⁠members, civilians, contractors, and their families," the spokesperson said.

The threat level at RAF Fairford has been raised to Delta. The threat level at RAF Lakenheath, which is also used by the USAF, has been raised to Charlie.

Threat level Delta suggests that there was prior intelligence to the potential attack and there is a large police presence deployed around the base.

As yet there has been no statement attributing the disrupted attack to any specific nation or organisation.

https://www.bbc.com/news/articles/cqrm99mm9l84o

UK counter-terrorism police are leading an investigation in which several men were arrested on suspicion of explosives offences near an RAF station which hosts the United States Air Force (USAF).

An Army explosive ordnance disposal team has been examining vehicles near RAF Fairford in Gloucestershire and homes in the nearby village of Whelford have been evacuated while investigations continue, police said.

The men were detained early on Sunday and a Hazardous Area Response Team has been deployed inside a security cordon at the base but officers believe the incident is contained.

The base has been recently used to deploy USAF bombers since the country's conflict in Iran began in February.

In March, four USAF bombers landed at RAF Fairford and the US started using British bases for "specific defensive operations" against Iranian missile sites after then prime minister Sir Keir Starmer granted permission for "defensive" US action from UK bases.

A government spokesperson said Prime Minister Andy Burnham was receiving regular updates on the evolving situation.

A police statement has just been made (13:56 BST):

Three suspicious white vans were reported by a telephone call to be heading towards the Fairford area at 12:45 am

Police stopped the vehicles and have detained 5 men, who remain in custody. They are held under suspicion of committing offences related to the Explosives Act.

The vehicles are being investigated by a military Explosive Ordnance Disposal team.

The police have just announced that the 5 detained men have been further charged with preparation of a terrorist act. [Corrected at 1427BST--JR]

An Anonymous Coward writes:

Open AI claims that AI has found a solution to the Navier-Stokes Millenium Prize problem.

The Navier-Stokes equations are a good model for most fluids we see around us like water and air. They are partial differential equations, and their solution is the velocity of the fluid --- a field that varies with both location in space and time. The Millenium Prize problem asks whether it is possible to start the equations with smooth initial conditions and smooth forcing, but still reach a solution with a singularity (i.e. infinite velocity at some time and point in space). One may either prove that such solutions stay smooth for all time, or one may construct an example which has a finite time "blowup"; the claim by OpenAI is that they found solutions with singularities. The result itself is interesting and it will most likely have some consequences within fluid dynamics, but these are medium to long term things that are hard to predict. I personally am not capable of judging the validity of the result (FWIW Sabine Hossenfelder explains reasonably well why the result might not be valid despite the "lean confirmation").

Sadly, the whole thing is clouded by allegations of not-exactly-plagiarism. In their statement OpenAI does not deny that their internal models may have been trained on research performed by others. To be more clear, there exists professor Tristan Buckmaster who was working with a friend from Anthropic on exactly this problem, and exactly this approach to the problem, and prof. Buckmaster used OpenAI's tools. I personally found prof. Buckmaster's statement a good read, and I don't want to forget this blog post by Curtis Pyke.

I believe the larger story is the AI agent collective. In the Hugging Face hack many AI agents started talking to each other and worked together to achieve their goals. OpenAI states that to solve the Navier Stokes problem, they purposefully set up to 10000 agents to work in groups that could communicate internally. At the same time OpenAI states that we are not prepared for AI --- the BBC has a broader text on controlling AI here.

I believe the larger story is that these AI agent collectives look a lot like global workspaces. This whole thing fits in nicely with the fact that humans consider themselves superior to other animals because they have language: unconstrained communication of different components is what leads the collective to have an actual chain/train of thought (the communication log).

I believe there is more to say, but I want to start a discussion, not to lecture. I apologize if I left anything important out.

Original Submission

Tim Curry has died at age 80

The British actor was known for iconic roles like Dr. Frank-N-Furter in The Rocky Horror Picture Show and Pennywise.

Curry earned three Tony nominations and a Daytime Emmy and released three musical albums in his career

The British star got his start on stage in the West End, starring in the original London production of Hair in 1968 after attending Birmingham University. But according to the actor, he fudged his own experience to get a part in the show. "When asked if he had professional experience and an Equity card, Tim lied about both," his website reads. "By the time the producers found out the truth, they were sufficiently impressed with his talent and presence to sponsor him for his union membership."

In 2012, Curry suffered a major stroke and has used a wheelchair since. Curry, who never married and has no children, mostly pulled back on his acting career then, focusing instead on voiceover projects.

Dolly Parton has passed away.

https://eu.usatoday.com/story/entertainment/music/2026/08/25/dolly-parton-death-cause-country-music-legend-singer/89232175007/

Dolly Parton, the "Queen of Country" singing icon with a personality as bold as her signature blond coif and rhinestone-encrusted outfits, has died. She was 80 years old.

Parton's death was announced in a video message from her family on her social media pages and confirmed to USA TODAY.

[...] Her nephew Bryan Seaver announced the death of his aunt [...]

[...] My family and I have shared a lifetime of beautiful memories with Dolly, but so have you. She has always been on your television, your record player, your CD, and on your phone playlist becoming an extended part of your family, whether you liked it or not. Our family and the team she has entrusted with her legacy will work diligently to ensure her spirit will live with us for ever.

Dolly was a farmer, just like her daddy. He farmed the soil; she farmed songs and happiness. Dolly called me and said she wants to rest in a beautiful bed of plush cotton because after a life wearing heavy rhinestones, she finally deserves to be comfortable and have some rest.

The 2nd crew member of the F15E shot down over Iran has been successfully rescued. The Pentagon has released that he is a colonel and was the Weapons Systems Officer on board the aircraft. He has suffered 'minor injuries' but is otherwise reported to be in good condition.

A large operation involving over a 'dozen' aircraft was mounted and he was recovered from high ground in a mountainous region. The rescue was conducted under fire from Iranian forces. No casualties have been reported.

looorg writes:

Venezuelan opposition leader María Corina Machado has been awarded this year's Nobel Peace Prize

Somewhat better then the IG Nobel is the actual Nobel prizes. Winners started to be announced this week. So far Medicine and Physics, others to be revealed in the following days as I write this.

Physics. "for the discovery of macroscopic quantum mechanical tunnelling and energy quantisation in an electric circuit"
Medicine. "for their discoveries concerning peripheral immune tolerance"

Chemistry.
Literature.

Peace.
Economic Science.

https://www.nobelprize.org/all-nobel-prizes-2025/

Original Submission

News is breaking that Robert Redford has died at his home age 89.

Qatar reserves the right to respond to the attack

Pentagon says there is no information of any casualties.

Iran claims that they have fired 6 missiles, one in response for each bomb dropped on Fordo. It appears that Qatar (and possibly the US too) were pre-warned.

All missiles were intercepted before hitting their targets.

Al Udeid is the the home of the Combined Air Operations Centre (CAOC) which is manned primarily by the US but also by UK and other allies. It is also a major military air hub in the region and would have had some responsibility for oversight of the recent US attack on the nuclear sites.

President Trump's Response

[paraphrasing] The Iranians have made a weak response and we were warned by them in advance. I thank Iran for the warning which gave us the ability to ensure that no lives were endangered. We hope that discussions can now be restarted. I will encourage Israel to also enable negotiations to be restarted. [end paraphrasing].

USA bombs Fordow, Natanz, and Isfahan
US President Donald Trump says American forces have conducted "very successful" strikes on Iranian nuclear facilities at Fordow, Natanz, and Isfahan and that all US planes are now out of Iranian airspace.

Trump's Truth Social
"We have completed our very successful attack on the three Nuclear sites in Iran, including Fordow, Natanz, and Esfahan. All planes are now outside of Iran air space. A full payload of BOMBS was dropped on the primary site, Fordow. All planes are safely on their way home. Congratulations to our great American Warriors. There is not another military in the World that could have done this. NOW IS THE TIME FOR PEACE! Thank you for your attention to this matter."

[Updated 22 Jun 1313z - following statements by Secretary of Defence and Chairman of the Joint Chiefs of Staff--JR]

Operation Midnight Hammer

75 x TLAMs - Precision Guided Weapons (PGW), 14 x MOPs GBU-57 used by 7 B2s, operational feint by sending 6 x B2s westward into the Pacific area, 7 x B2s continued eastwards. The B2s are still airborne and were observed refuelling over the Azores a few hours ago on FlightRadar24 (at least 18 tanker aircraft operating racetracks but the B2s were still radio silent). TLAMs were also fired by USN assets in the southern Persian Gulf. Over 120 aircraft involved in the mission including F16, F22, F35, ISTAR, AAR. Battle damage assessment will take time to collect and analyse.

US forces involved in the attack were not engaged and appear to have achieved total surprise. All assets are accounted for but some are still airborne.

Original Submission

quietus writes:

The President of the United States has declared that the 17 million inhabitants of the capital city of a country should immediately evacuate.

Republican Congressman (and engineer) Thomas Massie (Kentucky) has stated that he will introduce a war powers resolution today, Tuesday, to prevent the President of the United States going to war without first consulting Congress.

"This is not our war. But if it were, Congress must decide such matters according to our Constitution."

[Editor's Comment: This has been released with significant reservations. The departure of Trump from the G7 was accompanied with a statement that said "it certainly has nothing to do with a Cease Fire. Much bigger than that." Of course, this can be read in 2 different ways. It is possible that Iran is prepared to surrender or the US might be taking its own action in support of Israel. We would welcome your comments.--JR]

Original Submission

c0lo submitted the following article:

Mount Etna erupts as large plumes rise from Italian volcano:

Italy's Mount Etna has erupted, with large plumes of ash and smoke seen rising from the volcano.

Images and video from the island of Sicily showed volcanic material spilling out of the volcano on Monday morning.

A number of explosions of "increasing intensity" were recorded in the early hours on Monday morning, Italy's National Institute of Geophysics and Volcanology (INGV) Etna Observatory said.

The full scale of the eruption is currently unclear and disruption appears to be minimal, with flights departing and arriving as usual at the island's airports.

Mount Etna is one of the world's most active volcanoes, so eruptions are not uncommon and its outbursts rarely cause significant damage or injury.

Ground movements indicated the latest eruption happened on the south eastern edge of the volcano, according to INGV. This appears to be where a known 200m-wide vent is.

Footage shared throughout Monday shows a rapidly moving mix of ash, gas and rock - known as a pyroclastic flow - emerging from the site and moving down the side of the volcano.

Geologists monitoring the eruption said it was likely that part of volcano's crater collapsed and that this was the material being carried down its slopes.

Pyroclastic flow can be very dangerous to the surrounding area, but there has been no indication of an imminent threat.

In its most recent update, INGV noted that the volcanic material had not yet gone past the Valley of the Lion, the point on the approach to the summit where tourist trips stop.

INGV said it first recorded changes in the volcano's activity at 00:39 local time (22:39 GMT), before clarifying that there was an ongoing "Strombolian" eruption.

The size of Strombolian eruptions can vary but are often characterised by intermittent explosions, which occur due to the presence of gas in the magma chamber within the volcano.

When the gas bubbles reach the surface, they can burst suddenly, throwing material skywards. The process is not dissimilar to letting gas out of a fizzy drink.

These types of eruptions can be particularly dangerous for nearby aircraft.

A red alert was reportedly issued earlier on Monday, possibly suspending flights operating nearby, but this was later downgraded.

Mount Etna's last notable eruption came in February and caused the island's Catania airport to divert dozens of flights because of ash clouds.

Tourists were also warned to stay away from the volcano's lava flows.

See also:

• Mount Etna erupts, shooting a massive ash cloud into the sky and raising alerts

Original Submission

At 9:46 AM Eastern Daylight Time on June 1, 2025, instruments registered a geomagnetic K-index of 8, creeping toward 9 – a level rarely reached outside the most intense solar episodes.

Such readings signal strong electric currents racing through Earth's magnetic shield – the first sign that a severe solar storm disturbance has arrived.

Power operators, satellite controllers, and frequent flyers have good reason to pay attention. The disturbance is expected to last through at least June 3, bringing elevated radiation, intermittent radio dropouts, and a possible encore of the dazzling aurora that spilled far south earlier this spring.

The National Oceanic and Atmospheric Administration's Space Weather Prediction Center classifies the ongoing episode as G4, the second-highest rung on its five-step geomagnetic scale.

A glance at the agency's three-day outlook shows just how busy the next 48 hours could become: the greatest expected three-hour Kp for June 1–3 averages 7.67, with individual windows pushing well into G4 territory.

Forecasters concede there is a chance – though a small one – that conditions might briefly spike to G5, the extreme category reserved for once-in-a-decade storms.

[...] One of the perks of a strong storm is an expanded auroral oval. Forecasts hint that curtains of green and red could wander as far south as Alabama and northern California tonight and tomorrow night, weather permitting.

For many Americans, that means simply stepping outside after dark could reveal rippling colors usually reserved for Arctic latitudes.

The best views often come after local midnight, when Earth's night side lines up with the prevailing solar-wind flow.

Some sites of interest:
    • NOAA Space Weather Prediction Center
    • UAF Geophysical Institute Aurora Forecast
    • Aurora Labs Norway
    • Space Weather Live

Related: The Sun is Producing Strong Solar Flares; Are There More Than Expected During This Solar Cycle?