1 advisories

Security notes

Every advisory ever published. Phishing waves, key rotation notices, verification best practices. Read once, apply forever.

2026-02-14advisory

Phishing wave using prefix-collision clones.

Wave of lookalike onions circulating on unrelated Tor forums. All of them share the first four to eight characters with a real Nexus mirror, then diverge. Full-length letter-for-letter check against the current mirror set is the reliable answer. Editor recommendation: refuse addresses copied from anywhere other than a signed rotation.

Standing advice

Fetch the operator PGP key once, from a source you already trust. Never re-fetch.
Verify every rotation before you trust the address inside. See the verify walkthrough.
Compare the captcha string against your URL bar before typing the password. Every session.
Refuse addresses copied from anywhere other than a signed rotation or this changelog.
Bookmark this page. Reload it when in doubt.