スミハル retweeted
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailsc…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
Readers added context they thought people might want to know
The flaws require an already-approved device in the Tailscale network with SSH rules permitting access/forwarding; they enable post-compromise lateral movement and escalation inside the tailnet, not unauthenticated remote access from outside.
tailworm.com
brandefense.io/security-news/…
tailscale.com/security-bulle…
x.com/mmaunder/statu…
スミハル retweeted
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…
スミハル retweeted
ひい、まじかあ、AWSの容量が無くなるって言う日が来るとは思わなかったなー。
> Amazonのアンディ・ジャシーCEOは、AIインフラの需要急増により、AWSのクラウド容量が2027年まで大部分売り切れ状態で、2028年分も相当量が予約済みだと明らかにしました。
AWSのクラウド容量、2027年まで大部分が売り切れ状態とAmazonCEOが発言 jp.investing.com/news/compan…
スミハル retweeted
今回のPHPの騒ぎで、一番偉かったのは、PHP 7.xとか5.xにバックポートした人でも何でも無く、LTSに頼らずに普段から粛々と計画的に最新版のPHPに追随してたエンジニアと、そのコストを承認した上司なんだよ。そういう運用だったら、PHPの最新版が出たら差し替えるだけだった。
