Wednesday, October 21, 2026

Security

6 security stories from the Oct 21 edition.

PulseOne beat per story, in page order. Taller beats scored higher.

Attackers compromised 333 Tor exit nodes to intercept SSH connectionsScore 8/10 Eight eMudhra intermediate CA private keys are reported compromisedScore 8/10 Compromised eMudhra certificate keys could forge certificates for any domainScore 8/10 Feds suspect ransomware negotiator helped run ShinyHunters extortion siteScore 7/10 Report alleges TiDB Cloud breach exposed customer keys, queries and control-plane dataScore 7/10 macOS Secure Enclave keys enable Touch ID-protected SSH authenticationScore 7/10

Deep dive

Attackers compromised 333 Tor exit nodes to intercept SSH connections

Attackers installed an OpenSSH backdoor on 333 Tor exit nodes and redirected SSH connections for interception after gaining access two months earlier. The account offers concrete lessons about relay trust, credential theft and incident response.

What• Attackers compromised 333 Tor exit nodes and used them to intercept SSH connections.
How• The nodes redirected SSH traffic to 12 interception servers, where attackers could steal passwords, observe commands and infect servers with Ebury.
Why it matters• SSH host-key warnings and the trust placed in exit relays matter when designing secure remote-access systems.

Original · kaba.cx 4 min read HN 351 pts · 88 comments Lobsters 33 pts · 1 comment

Notes & discussion

SSH traffic routed through infected Tor exits was redirected to interception servers and onward to the user's server. Sketched from the article's own text.

Vulnerability

Eight eMudhra intermediate CA private keys are reported compromised

The report says eight intermediate CA keys chain to roots trusted by major browser and operating-system programs, and lists certificate blocking actions. Engineers responsible for trust stores and certificate operations should understand the scope and response.

Original · emudhra.we-have-a-problem.com 4 min read HN 803 pts · 368 comments

Notes & discussion

Vulnerability

Compromised eMudhra certificate keys could forge certificates for any domain

Eight compromised intermediate-certificate keys were weak enough to enable forged certificates for any domain; Cloudflare says it updated clients and deployed mitigations across several products. The incident highlights the reach of compromised certificate trust and the response work it triggers.

Original · blog.cloudflare.com by Christopher Patton et al.4 min read

Notes & discussion

Feds suspect ransomware negotiator helped run ShinyHunters extortion site

Investigators suspect an executive at a ransomware negotiation firm helped ShinyHunters operate a site pressuring victims to pay. The account highlights risks around trust and conflicts of interest in incident response.

Original · krebsonsecurity.com 11 min read HN 163 pts · 67 comments

Notes & discussion

Report alleges TiDB Cloud breach exposed customer keys, queries and control-plane data

The report claims 10.6 TB was exfiltrated, including 115,308 plaintext customer API keys and 20.6 million SQL statements, across TiDB Cloud and related systems. If substantiated, the scope makes this a significant cloud-platform security incident.

Original · fulcrumsec.vg 9 min read HN 95 pts · 13 comments

Notes & discussion

Guide

macOS Secure Enclave keys enable Touch ID-protected SSH authentication

The guide shows how to create SSH identities in the Secure Enclave, where private key material cannot be extracted and Touch ID can protect its use. Engineers can weigh this approach against file-based keys for SSH and Git workflows.

Original · nmattia.com 9 min read Lobsters 54 pts · 22 comments

Notes & discussion