Eight broken CAs, a Rust port that runs an agent for itself, and fake stats nobody fact-checked

00:00:04 Eight intermediate certificate authority keys were compromised, chaining to roots in the Mozilla, Microsoft, Apple, and Chrome trust stores. Anyone holding those keys can now issue certificates that look legitimate to almost everyone. The eight intermediates belong to an Indian operator called Emudhra.

00:00:26 Reporter Wayne proved access on October 17th by signing a message with each key and reported it through the root program channels. Firefox and Chrome blocked the certificates two days later. Apple followed on the 19th. Microsoft patched on the 20th, which is today.

00:00:46 But here's where this gets wider than a browser update: many clients — Go apps, Python services, Rust tooling, Node environments — don't consume revocation information by default. They rely on software updates to remove trust. That means the patching surface isn't just browsers; it's every system that bundles its own root store.

00:01:12 Go 1.27.3 and 1.26.10 dropped patched releases this morning. rustls-webpki hit 0.103.16. Python's certifi went to 2026.10.19. The site has a table of every affected package and its patch version. What sticks with me is how thin the boundary is between a single compromised intermediate and a world where anyone can impersonate any service for anyone running older software.

00:01:40 This isn't a browser bug. It's a root-of-trust gap.

00:01:44 Cloudflare shipped tsrs — a Rust port of the TypeScript compiler. Up to eight times faster and uses roughly seventy percent less memory than TypeScript 7.0 with the same number of worker threads. The important detail is that this isn't a fork. Max Schwenk from Owner.com is leading the work in close collaboration with the TypeScript team, who retain full control over the language design.

00:02:12 The goal here is performance, not divergence. Rust wins on memory efficiency for WebAssembly because you don't ship Go's garbage collector alongside it. That matters on Cloudflare Workers where tiny memory footprints let you run entire build and deployment systems in tight loops.

00:02:33 It also means these tools can run safely client-side in a browser or on embedded devices. The maintenance shift comes from how they plan to keep tsrs in sync with upstream TypeScript. They're using an AI agent that reviews diffs every morning, opens tracking issues for anything that could affect compatibility, and regenerates the test matrix nightly.

00:02:59 When gaps appear, agents propose fixes across both codebases. Theo Browne is merging tsc-rs and tsrs into a single package. The experimental release is on npm now if you want to try it.

00:03:13 Metehan Yesilyurt at Peec AI ran a fifty-dollar experiment. He bought a new domain, generated fifty thousand statistics in a single day using GPT-4.1, added fifteen thousand listicles on top. Every number was invented. He never checked a single one. Google deindexed the site quickly after two updates went live.

00:03:35 But ChatGPT never stopped pulling from it. In the last thirty days alone, seventy-two thousand requests came from ChatGPT-User — that's the agent ChatGPT uses to fetch pages in real time while answering questions. Not training crawls. Actual retrieval. After seven months, the site had three hundred and thirty referring domains, including Shopify, DHL, and Bluehost.

00:04:02 Its fake numbers showed up in an academic paper, in investment research from Qatar's largest financial group, in an economics publication in India, and in a Canadian influencer research report. Retrieval and ranking are separate problems for generative AI search.

00:04:22 A page can be invisible on Google and still perform well through every step of large language model fanout queries — sub-query generation, candidate pulling, reranking, and ground-truth fetching. StateGlobe ranked second for visibility behind Statista on several prompts in October, even though Google had buried it.

00:04:45 The uncomfortable implication that Metehan flags is citation laundering. A fake number starts with zero authority on day one. Then an academic paper cites it. Then a bank. Each citation makes the source look more trustworthy without changing the underlying data.

00:05:04 And if those pages end up in web crawls, and those crawls feed training data, a number that started as a model guess can become something the next model treats as fact.

00:05:16 Someone compromised 333 Tor exit relays in a coordinated SSH man-in-the-middle campaign. That's roughly ten percent of all Tor exits. The operator who caught it, posting on kaba.cx, says the attackers gained access to the servers back in August and quietly deployed Ebury 1.8.3 — an OpenSSH credential stealer that's been around since 2009 with over four hundred thousand known infections.

00:05:45 By October second they activated the interception. Exit nodes under their control redirected Port twenty-two traffic to twelve SSH interception servers. Users saw a normal-looking login prompt, entered credentials, and the attacker stole the password, observed every command typed on the remote machine, and pushed Ebury onto it as well.

00:06:10 The reporter built a script using exitmap to test all three thousand relays by pinning an exit node and checking SSH fingerprints from both ends. Around a dozen served fake fingerprints. Over three hundred didn't intercept anything but still redirected through the same servers — which was enough to confirm infection.

00:06:34 The Tor network health team called it: they'd never seen this pattern before. All infected relays were shut down by October fifth. The big unanswered question is how all those servers got accessed in the first place. One theory is the hosting company itself was compromised, but no one's confirmed that yet.

00:06:57 The operator is going to buy hardware keys today.

00:07:01 The trust story today spans eight intermediate CAs with compromised keys and a patching surface that goes far beyond browsers. The tsrs port shows how AI-assisted maintenance has moved into language infrastructure itself. The fake stats experiment demonstrates that retrieval creates authority independent of ranking in ways that matter for research integrity.

00:07:22 And the Tor exit compromise is a reminder that dormant backdoors keep resurfacing, waiting for a new network to walk through. On the trust chain front, if you run services with older package versions, check your ca-certificates today. For the rest of us, this is another layer on the same question: what gets trusted when nobody's checking the source.

00:07:44 — Seln