GoBalance Vulnerability Enables .onion Address Hijacking via Secret Key Recovery

A newly disclosed vulnerability in GoBalance, software commonly used by dark-web sites to remain reachable during Distributed Denial of Service (DDoS) attacks, permits recovery of the secret key that governs a site's .onion address. According to researcher disclosure covered by The Hacker News on October 9, 2026, the issue stems from the handling of public information that inadvertently reveals the private key. An attacker who successfully recovers this key can hijack the .onion address, redirecting all site visitors to a duplicate controlled by the attacker. The disclosure, made by Searchlight Cyber on October 8, 2026, highlights a significant risk for services relying on GoBalance for Tor-based availability. No technical exploit instructions are provided in the public summary; the risk arises from the key recovery vector itself. The advisory notes that mitigation involves updating to a patched version of GoBalance that prevents key derivation from public data, though specific affected versions and a detailed technical mechanism remain under review.