Tech News, October 10: Flax Typhoon’s Double Hit, GhostAction Returns, and the Internet’s Key Change

Friday was a heavy day for defenders. The United States hit a Chinese hacking operation from two directions at once, a supply-chain campaign returned to GitHub with stolen maintainer accounts, and the countdown hit its last day for an internet infrastructure change that has only happened once before. Meanwhile, Let’s Encrypt gave site operators four months’ notice that their certificate renewals are about to get more frequent. Here is what happened and what to do about it.

The U.S. Hits Flax Typhoon Twice in One Week

The Justice Department said on Thursday it is seizing seven internet domains used by hackers working with the Chinese IT firm Integrity Technology Group, in a move aimed at disrupting the group’s ability to scan and hack U.S. and foreign critical infrastructure systems. The department described it as its second public effort against the company’s infrastructure. The first, in September 2024, took down a botnet of more than 250,000 compromised consumer devices. Then-FBI Director Christopher Wray said at the time that Integrity Technology Group was behind a major Chinese hacking group nicknamed “Flax Typhoon” and was carrying out reconnaissance for Beijing’s security agencies. The Chinese Embassy in Washington did not immediately respond to a request for comment; Beijing routinely denies conducting hacking operations. Reuters

On the same day, the U.S. Cybersecurity and Infrastructure Security Agency added five security flaws to its Known Exploited Vulnerabilities catalog, following their abuse by Flax Typhoon, and set an October 11 deadline for federal agencies to remediate them. Four of the flaws were named in coverage:

Why it matters: the domain seizure and the KEV deadline arrive as one coordinated response to the same actor. If you run any of the four products above — note that several are old, widely deployed, and in one case a decade-old FTP server — patch them before the weekend. The Hacker News

GhostAction Returns to GitHub, Stealing Developer Secrets

Attackers compromised two prominent open-source maintainer accounts to plant a credential-stealing workflow in more than 340 repositories. According to StepSecurity, the account of Takashi Kitao, author of the 18,400-star game engine pyxel, was used to push a malicious workflow to 27 repositories starting at 13:20 UTC. Eight hours later, the account of Henry Wu (henrywoo), the original author of Uber’s athenadriver, was used to push the same workflow to 318 repositories in a 16-minute window, between 21:10 and 21:26 UTC.

Socket reported that as of October 9, more than 500 GitHub accounts had committed the malicious workflow to tens of thousands of repositories since October 7. The campaign is attributed to GhostAction, a supply-chain operation that first came to light in September 2025, when it hit 817 repositories across 327 users and exfiltrated 3,325 secrets, including PyPI, npm, and Docker Hub tokens. Both accounts pushed a workflow named “Security Audit” (security-audit.yml) or “GitHub Actions Security” (github_actions_security.yml), designed to exfiltrate data to a hard-coded IP address, 193.32.204[.]199, over plain HTTP. The captured data includes the repository’s GitHub Actions secrets — CI/CD secrets and cloud, AI, and SaaS credentials present in the working tree and the entire git history, such as AWS keys, Anthropic, OpenAI, and OpenRouter API keys, and GitHub and GitLab tokens. StepSecurity says the attacker most likely obtained the maintainers’ GitHub credentials from leaked personal access tokens in infostealer logs or credential dumps. The Hacker News

Why it matters: trusted developer accounts are being weaponized to spread malware, and the payload hunts credentials far beyond the current checkout — anything ever committed to the repository’s history. If you have a repository you maintain or contribute to, check your Actions workflows for security-audit.yml or github_actions_security.yml, rotate any secrets that could have been exposed, and treat the git history as compromised.

Tomorrow, the Internet Changes Its Master Key

On October 11, 2026, the DNS root is scheduled to change its key-signing key for only the second time ever. The key anchors DNSSEC’s chain of trust, which lets DNS resolvers authenticate answers using cryptographic signatures. The old key, KSK-2017 (key tag 20326), hands over root signing to KSK-2024 (key tag 38696). The new key has been published in the root’s DNSKEY set since January 11, 2025, so resolvers with automatic trust-anchor updates have had more than a year and a half to learn it; the old key will be revoked and its private key deleted in 2027. Cloudflare

Most website operators need to do nothing. If you run a DNSSEC-validating resolver, confirm it trusts KSK-2024 and follow your software vendor’s instructions if the trust anchor is missing — without it, users can find healthy websites unreachable after the rollover. Cloudflare has published a browser-based readiness test built on the RFC 8509 trust anchor sentinel protocol, which asks your resolver directly whether it trusts the new key. Technobezz

Why it matters: this is the rare infrastructure event where the failure mode is “every website looks down at once.” The risk is concentrated on self-run resolvers with manually configured trust anchors; public resolvers from Google, Cloudflare, Quad9, and most ISPs already have the new key.

Let’s Encrypt Cuts Certificate Lifetimes to 64 Days

Let’s Encrypt announced on October 7 that it will cut the default lifetime of its free TLS certificates from 90 days to 64 days, starting February 10, 2027. Every certificate issued or renewed on or after that date gets 64 days; existing certificates keep their 90-day life and will not be revoked, with the last legacy 90-day certificate expected to expire on May 11, 2027. The staging environment switches first, on October 14, 2026, so operators can test without risking production outages. A further cut to 45 days is scheduled for February 16, 2028. The authorization reuse period — the time after proving domain control during which Let’s Encrypt issues certificates without asking again — shrinks from 30 days to 10 days. Rate limits, ACME endpoints, and certificate chains are unchanged. Geek Slop Digital Advisors

Why it matters: if your renewals run through a correctly configured ACME client like Certbot, nothing changes. If any step is manual — a cron job with a hard-coded schedule, certificates copied between machines by hand — the 64-day window gives you less margin before browsers show a warning page instead of your site. Use the staging switch on October 14 to find out which setup you have. Geek Oven

Key takeaways

• The U.S. is simultaneously seizing Flax Typhoon domains and ordering federal patches for five flaws the group exploited — check your systems for the four named CVEs before the October 11 deadline.
• GhostAction is back on GitHub: inspect your Actions workflows for security-audit.yml or github_actions_security.yml and rotate secrets, including anything in git history.
• The DNS root KSK rollover happens October 11 — only the second ever. Run the readiness test if you operate your own validating resolver.
• Let’s Encrypt moves to 64-day certificates on February 10, 2027 (staging October 14, 2026). Verify your renewal automation is fully hands-off before then.
• Several of this week’s threats are old bugs in widely deployed software — ProFTPD, Struts, ONLYOFFICE — not exotic zero-days. Patching basics remain the highest-leverage defense.

References

• Reuters: US announces effort to disrupt hacking infrastructure run by China’s Integrity Tech Group
• The Hacker News: Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline
• The Hacker News: Credential-Stealing GitHub Actions Workflows Planted in Tens of Thousands of Repositories
• Cloudflare: The keys to the Internet change on October 11, 2026. Are you ready?
• Technobezz: Cloudflare Offers DNS Readiness Test Ahead of Root Key Change
• Geek Slop: Let’s Encrypt Cuts SSL Cert Lifetimes To 64 Days
• Digital Advisors: Let’s Encrypt certificates drop from 90 to 64 days
• Geek Oven: Let’s Encrypt’s 64-day certificates — how to prepare your servers