2026 Tor Exit Relay Hijacking: SSH Interception and Response

The October 2026 Tor exit-relay incident involved an attacker-controlled redirection path affecting SSH traffic. Firsthand active testing documented 333 exit relays redirecting connections, while separate analysis of historical directory records found 377 relays matching suspicious exit-policy changes. These are different populations and neither establishes a number of stolen credentials or infected hosts. An affected operator independently found Ebury malware on two examined servers. ryo.news follows the incident, network-authority containment, authentication failures, unresolved attribution and lessons for independently operated privacy infrastructure.