← All stories

Vulnerabilities

Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws

By SecurityWeek1 min read

Tailscale is rushing to prepare patches for vulnerabilities in its Tailscale SSH feature, dubbed 'Tailworm,' after details of the flaws were published over the weekend before any fixes were available, SecurityWeek reports.

Cover for a vulnerabilities story

Tailscale is hurrying to ready security patches after details of vulnerabilities affecting its Tailscale SSH feature were made public ahead of any available fix, according to SecurityWeek.

The flaws have been collectively dubbed "Tailworm." Per the SecurityWeek report, information about the vulnerabilities surfaced over the weekend in what appears to have been an uncoordinated disclosure, meaning the technical details were published before Tailscale had released patches to address them. Such disclosures can leave users exposed, since attackers may attempt to exploit publicly documented weaknesses while no official remediation exists.

Tailscale SSH is a feature of the Tailscale mesh networking service that lets users handle SSH authentication and connectivity through their Tailscale network rather than traditional key management. Flaws in this component could therefore have implications for remote access security in environments that rely on it, though the available report does not specify the exact nature or severity of the weaknesses.

According to SecurityWeek, Tailscale is preparing a patch in response to the disclosure. The report does not indicate whether the vulnerabilities have been exploited in the wild, nor does it provide details on affected versions.

Users and administrators who depend on Tailscale SSH should monitor Tailscale's official communications for the incoming patches and apply them promptly once released. Until fixes are available, organizations may wish to review their exposure and consider interim risk-reduction measures where feasible. All details in this piece come from SecurityWeek.

Source: SecurityWeek

Cover for a vulnerabilities story

Vulnerabilities

Brotli Compression Bug (CVE-2026-111497) Reaches Far Beyond Node.js

A remotely exploitable out-of-bounds write flaw in Google's widely used Brotli compression library, publicly disclosed by Node.js on October 21, 2026, affects software well beyond the Node.js ecosystem, Help Net Security reported. Attackers who can get an application to decompress crafted Brotli data via node:zlib can corrupt process memory, potentially causing crashes or memory disclosure.

1 min read

AI-written summary Source: Help Net Security · Fetched

Cover for a vulnerabilities story

Vulnerabilities

Hackers Flood Inboxes With Spam, Then Pose as IT Support on Microsoft Teams

Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.

1 min read

AI-written summary Source: Help Net Security · Fetched

Cover for a vulnerabilities story

Vulnerabilities

Industrial Vendors Check Products for PHP2Shell Vulnerabilities

Siemens, Schneider Electric, ABB and other industrial vendors have confirmed that some of their products are affected by the PHP2Shell vulnerabilities, SecurityWeek reported. The companies are reviewing their product portfolios to determine their exposure.

1 min read

AI-written summary Source: SecurityWeek · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.