SoylentNews

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

Then the attacker connected from the management server to a second Tor server, called Switzerland2, through SSH, using an RSA key that, for unknown reasons, investigators couldn't find among Switzerland2's authorized keys. With administrative control of Switzerland2, the attackers installed Ebury there as well. Finally, the attacker reconfigured settings on two exit nodes that Switzerland2 hosted.

Ultimately, 333 exit relays were involved in the SSH and email interception campaign, although investigators haven't established how the attackers gained control of all the underlying servers. The attackers then reconfigured the servers. One set of changes redirected SSH traffic traversing Tor to one of 12 attacker-controlled interceptor servers. Tor users who ignored warnings that the SSH host key had changed would then enter their SSH passwords.

A second set of changes caused the exit nodes to block ports 25, 465, 587, 993 and 995—used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections, the attackers used their access to the exit nodes to obtain unencrypted messages. It's unclear whether any such downgrade attempts succeeded. The hijacking occurred from October 2 to October 5.

Tor volunteers partially outlined the initial compromise of the management server and Switzerland2 and the attempt to intercept unencrypted email. Tuesday's report revealed many new details, including how many exit nodes were compromised and how the attackers used them to redirect SSH traffic.

"If you happen to get a circuit that exits over one of those 333 infected exit nodes, you won't notice anything at first," Kaba, the name of the Tor volunteer who authored the post, wrote. "Encrypted web traffic is forwarded as usual, but if you attempt an SSH connection over Port 22, you're unknowingly redirected to one of 12 SSH interception servers. That's exactly what happened to me on Friday morning." Kaba then received the following warning:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.
Please contact your system administrator.

The volunteer investigated further and found that when people ignored the warning, the attacker (1) stole the SSH password, (2) opened a connection to the server and observed all typed commands, and (3) opened a second connection and infected the server with Ebury.

To investigate the campaign, Kaba created a script that polled all of Tor's roughly 3,000 exit nodes to check whether they received a correct SSH fingerprint from a test server. The test server then checked whether the connection came from a pinned exit node or one of 12 SSH interception servers used by the attacker. The volunteer further set up a honeypot to observe the interception software attempting to log in and install Ebury.

Several mysteries remain. Tor volunteers still don't know how the attackers accessed so many servers. One possibility is that a company hosting them was hacked, but the theory is inconclusive. Another open question is who is behind the attack. "The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group," Kaba wrote. "Though this too is just speculation."

A last perplexing finding: why did Switzerland2 accept an RSA key when there's no evidence it was an authorized SSH certificate?

The takeaway from the event is the crucial role defense in depth plays in preventing data theft in mass hacks like this one. Those measures include configuring email accounts to accept only encrypted traffic and reject unencrypted ports. Another is to disable password authentication in favor of SSH keys.

Source BBC Television News: (17:18 BST Sep 2026)

The Prime Minister has stated that the UK now believe that Iran was behind to the attempted attack on RAF Fairford.

The Iranian Ambassador has strongly denied any connection with the incident.

See previous reporting: https://soylentnews.org/article.pl?sid=26/09/28/1259254 https://soylentnews.org/article.pl?sid=26/09/27/115249

Source: BBC News: 07:18 BST 02 Oct 2026

The police have confirmed the arrest of a dual nationality (UK/Iran) man in the London area, linked to the incident at RAF Fairford on Sunday.

Source: BBC Television.

The UK Police have announced that all 5 men arrested in connection with the suspected terrorist attack attempt at RAF Fairford are UK nationals in their 20s from the London area.

For previous reporting see: https://soylentnews.org/breakingnews/article.pl?sid=26/09/27/115249

The Head of Counter Terrorism Police (CTP) has given an public announcement at 15:45 BST:

The 5 individuals who have been arrested are being released on police bail with significant restrictions on who they may contact, on reporting regularly and movement. They remain under investigation.

They are currently being released while remaining under charges relating to the Police and Criminal Evidence Act (PACE). No mention was made relating to earlier charges.

The CTP have numerous new leads that they are following. They are keeping an open mind about who might ultimately be behind the attempt. They stress that it must be remembered that individuals may be used as proxies without necessarily knowing who is directing the attempt, or even knowing that they were being manipulated.

The alert states at both Fairford and Lakenheath remain as previously announced.

The Head of CTP stated that the alert was raised by 2 phone calls made by civilians. Nothing was said about any prior intelligence.

The latest statement by the CTP (19:25BST 29 Sep 2026):

No explosives were found in the vehicles used by the 5 men arrested near RAF Fairford. A quantity of vehicle fuel was found. Searches of the homes of the 5 men have not revealed anything significant to the investigation.

Without any further evidence the individuals were released on bail. The decision was based on insufficient evidence to justify holding the 5 offenders longer although they could always be re-arrested if it is subsequently justified, and 'strategic' considerations. The investigation is continuing with close liaison between the relevant security agencies in the UK, and with the US.

Source: BBC (07:01BST 30 Sep 2026)

One of the 5 men arrested in connection with the incident near RAF Fairford had phoned the police (999) himself.

The Prime Minister has stated that the UK now believe that Iran was linked to the attempted attack on RAF Fairford.

The Iranian Ambassador has strongly denied any connection with the incident.

https://edition.cnn.com/2026/09/27/uk/fairford-arrests-uk-raf-us-intl

UK counter-terrorism police are leading an investigation after several men were arrested on suspicion of explosives offenses near an air base used by US forces.

A number of properties were evacuated in the Whelford area in the county of Gloucestershire "following the declaration of a major incident," a police statement said.

"The Army's specialist explosive ordnance disposal team are currently examining a number of vehicles," the statement said

Whelford is close to the Royal Air Force base at Fairford which has been used by US B-1 bombers involved in targeting Iran and is a forward operating location for US Global Strike Command, which is tasked with managing long-distance strikes.

A US air force spokesperson at Fairford - where the 501st ​Combat Support Wing is based - told CNN: "For operational security reasons we will not discuss specific force protection measures."

The unit "remains vigilant and will take appropriate actions to ensure the safety and security of our US service ⁠members, civilians, contractors, and their families," the spokesperson said.

The threat level at RAF Fairford has been raised to Delta. The threat level at RAF Lakenheath, which is also used by the USAF, has been raised to Charlie.

Threat level Delta suggests that there was prior intelligence to the potential attack and there is a large police presence deployed around the base.

As yet there has been no statement attributing the disrupted attack to any specific nation or organisation.

https://www.bbc.com/news/articles/cqrm99mm9l84o

UK counter-terrorism police are leading an investigation in which several men were arrested on suspicion of explosives offences near an RAF station which hosts the United States Air Force (USAF).

An Army explosive ordnance disposal team has been examining vehicles near RAF Fairford in Gloucestershire and homes in the nearby village of Whelford have been evacuated while investigations continue, police said.

The men were detained early on Sunday and a Hazardous Area Response Team has been deployed inside a security cordon at the base but officers believe the incident is contained.

The base has been recently used to deploy USAF bombers since the country's conflict in Iran began in February.

In March, four USAF bombers landed at RAF Fairford and the US started using British bases for "specific defensive operations" against Iranian missile sites after then prime minister Sir Keir Starmer granted permission for "defensive" US action from UK bases.

A government spokesperson said Prime Minister Andy Burnham was receiving regular updates on the evolving situation.

A police statement has just been made (13:56 BST):

Three suspicious white vans were reported by a telephone call to be heading towards the Fairford area at 12:45 am

Police stopped the vehicles and have detained 5 men, who remain in custody. They are held under suspicion of committing offences related to the Explosives Act.

The vehicles are being investigated by a military Explosive Ordnance Disposal team.

The police have just announced that the 5 detained men have been further charged with preparation of a terrorist act. [Corrected at 1427BST--JR]

An Anonymous Coward writes:

Open AI claims that AI has found a solution to the Navier-Stokes Millenium Prize problem.

The Navier-Stokes equations are a good model for most fluids we see around us like water and air. They are partial differential equations, and their solution is the velocity of the fluid --- a field that varies with both location in space and time. The Millenium Prize problem asks whether it is possible to start the equations with smooth initial conditions and smooth forcing, but still reach a solution with a singularity (i.e. infinite velocity at some time and point in space). One may either prove that such solutions stay smooth for all time, or one may construct an example which has a finite time "blowup"; the claim by OpenAI is that they found solutions with singularities. The result itself is interesting and it will most likely have some consequences within fluid dynamics, but these are medium to long term things that are hard to predict. I personally am not capable of judging the validity of the result (FWIW Sabine Hossenfelder explains reasonably well why the result might not be valid despite the "lean confirmation").

Sadly, the whole thing is clouded by allegations of not-exactly-plagiarism. In their statement OpenAI does not deny that their internal models may have been trained on research performed by others. To be more clear, there exists professor Tristan Buckmaster who was working with a friend from Anthropic on exactly this problem, and exactly this approach to the problem, and prof. Buckmaster used OpenAI's tools. I personally found prof. Buckmaster's statement a good read, and I don't want to forget this blog post by Curtis Pyke.

I believe the larger story is the AI agent collective. In the Hugging Face hack many AI agents started talking to each other and worked together to achieve their goals. OpenAI states that to solve the Navier Stokes problem, they purposefully set up to 10000 agents to work in groups that could communicate internally. At the same time OpenAI states that we are not prepared for AI --- the BBC has a broader text on controlling AI here.

I believe the larger story is that these AI agent collectives look a lot like global workspaces. This whole thing fits in nicely with the fact that humans consider themselves superior to other animals because they have language: unconstrained communication of different components is what leads the collective to have an actual chain/train of thought (the communication log).

I believe there is more to say, but I want to start a discussion, not to lecture. I apologize if I left anything important out.

Original Submission

Tim Curry has died at age 80

The British actor was known for iconic roles like Dr. Frank-N-Furter in The Rocky Horror Picture Show and Pennywise.

Curry earned three Tony nominations and a Daytime Emmy and released three musical albums in his career

The British star got his start on stage in the West End, starring in the original London production of Hair in 1968 after attending Birmingham University. But according to the actor, he fudged his own experience to get a part in the show. "When asked if he had professional experience and an Equity card, Tim lied about both," his website reads. "By the time the producers found out the truth, they were sufficiently impressed with his talent and presence to sponsor him for his union membership."

In 2012, Curry suffered a major stroke and has used a wheelchair since. Curry, who never married and has no children, mostly pulled back on his acting career then, focusing instead on voiceover projects.

Dolly Parton has passed away.

https://eu.usatoday.com/story/entertainment/music/2026/08/25/dolly-parton-death-cause-country-music-legend-singer/89232175007/

Dolly Parton, the "Queen of Country" singing icon with a personality as bold as her signature blond coif and rhinestone-encrusted outfits, has died. She was 80 years old.

Parton's death was announced in a video message from her family on her social media pages and confirmed to USA TODAY.

[...] Her nephew Bryan Seaver announced the death of his aunt [...]

[...] My family and I have shared a lifetime of beautiful memories with Dolly, but so have you. She has always been on your television, your record player, your CD, and on your phone playlist becoming an extended part of your family, whether you liked it or not. Our family and the team she has entrusted with her legacy will work diligently to ensure her spirit will live with us for ever.

Dolly was a farmer, just like her daddy. He farmed the soil; she farmed songs and happiness. Dolly called me and said she wants to rest in a beautiful bed of plush cotton because after a life wearing heavy rhinestones, she finally deserves to be comfortable and have some rest.