← Wednesday 28 Octobernote 7 of 10
CybersecurityWed 28 Oct 2026 · 7 of 10

Tailscale prepares patch after uncoordinated Tailworm disclosure

Verified · 8/8 supported1 cited · 1 min read

securityweek.com reports that Tailscale is preparing a client update to address privilege escalation flaws in Tailscale SSH following an uncoordinated public disclosure of the Tailworm vulnerabilities . securityweek.com reports that the Tailworm report from Cyberdione Labs lists 11 findings affecting Tailscale client version 1.104.2 and headscale version 0.29.5 . securityweek.com reports that six of the findings are rated high severity, with four specifically concerning Tailscale SSH, which relies on device identity and network policy instead of passwords or keys . securityweek.com reports that the report states Tailscale SSH performs certain forwarding operations with root privileges and that the intended safeguards can be bypassed . securityweek.com reports that an attacker who compromises one device could exploit any server that device is permitted to reach via Tailscale SSH, leveraging the bypassed safeguards . securityweek.com reports that Cyberdione Labs released the vulnerability report before any patches were available, drawing criticism on social media, while the researchers argued that rapid awareness would accelerate remediation .

Why it matters. securityweek.com reports that the upcoming patch will address the privilege escalation weaknesses, helping protect organizations that rely on Tailscale SSH . securityweek.com reports that the researchers believe rapid awareness will accelerate remediation .

Earlier on Cybersecurity

Tue 27 Oct 2026Industrial Vendors Alert Customers to PHP2Shell Vulnerabilitiessecurityweek.com reports that industrial vendors Siemens, Schneider Electric, ABB, Rockwell Automation and Johnson Controls have confirmed that some of their OT products are affected by the PHP2Shell vulnerabilities. securityweek.com reports that PHP2Shell refers to CVE‑2026‑109618 and CVE‑2026‑109619, two critical unauthenticated remote code execution flaws in the PHP engine. securityweek.com reports that PHP released patches on October 21 in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 after a leak of the vulnerabilities. securityweek.com reports that the first exploitation attempt was observed on October 17, before the patches, and Cloudflare has reported millions of attempts, with the first confirmed attacks aimed at honeypots reported over the weekend. securityweek.com reports that Schneider Electric identified three affected products—EcoStruxure Security Expert, ProLeiT LINEoptimize and EcoStruxure Control Engineering—while other vendors are still assessing exposure or have determined no impact.Sat 24 Oct 2026Mirai Botnet Targets Newly Patched PHP2Shell Vulnerabilitiessecurityweek.com reports that researchers linked PHP2Shell attack attempts to the Mirai botnet and demonstrated an ASLR bypass, but no successful in‑the‑wild compromise has been confirmed. securityweek.com reports that emergency patches for the PHP2Shell vulnerabilities (CVE‑2026‑109618 and CVE‑2026‑109619) were released on October 21, one day earlier than planned after the CVE identifiers leaked online. securityweek.com reports that the two critical bugs allow unauthenticated remote code execution and have a CVSS v4.0 score of 9.2. securityweek.com reports that precautionary shutdowns affected many organizations, with European government, school and hospital websites going dark on October 21 and the UK government reporting 32 services unavailable and four partially unavailable. securityweek.com reports that Amazon detected the first exploitation attempt on October 17, that attack activity surged after the patches were released, and that a security firm built an exploit that bypasses a key memory protection (ASLR).Sat 24 Oct 2026Self‑Rebuilding Heartbreaker macOS Ransomware Remains Undetectedsecurityweek.com reports that Heartbreaker is a Rust‑based macOS ransomware sample that was uploaded to VirusTotal in May 2025. securityweek.com reports that the malware remains undetected by every antivirus engine on VirusTotal as of the report. securityweek.com reports that it attempts to establish persistence via a LaunchAgent before encrypting files in the user’s Downloads folder. securityweek.com reports that Heartbreaker tries to change its hash by extracting its embedded source code, randomizing identifiers, adding junk functions, and recompiling itself, even attempting to install Rust if missing. securityweek.com reports that researcher Patrick Wardle believes the ransomware is unlikely to become a major threat because it uses a single hardcoded AES key that allows free file recovery.
Next · Climate techCleanTechnica reports growth and new developments in central heat pump water heaters →