[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f3klmuswk13jgf":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":61,"author":76,"related":78},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[63,66],{"key":64,"label":65},"opinion","Opinion",{"key":67,"label":68},"security","Security",6,"\u003Cp>I like Tailscale. I have recommended it, and the WireGuard engine underneath it is excellent. But this weekend's \u003Ca href=\"https:\u002F\u002Ftailworm.com\u002F?ref=ghost.jdneer.com\">Tailworm report\u003C\u002Fa> is a good moment to say something I have believed for a while: a mesh VPN agent is not \"just the VPN.\" It is a privileged daemon on every machine you install it on, and you should treat it that way.\u003C\u002Fp>\u003Ch2 id=\"what-was-actually-found\">What was actually found\u003C\u002Fh2>\u003Cp>Erica Windisch of Cyberdione Labs published Tailworm on October 25. It lists 11 findings against Tailscale 1.104.2 and the self-hosted headscale 0.29.5 control server, all reproduced in her lab between October 22 and 24. The headline issue is in Tailscale SSH, the SSH server built into the \u003Ccode>tailscaled\u003C\u002Fcode> agent.\u003C\u002Fp>\u003Cp>That agent runs as root. According to the report, when a connecting device is allowed to use SSH port forwarding, Unix socket forwarding (\u003Ccode>ssh -L\u003C\u002Fcode> and \u003Ccode>ssh -R\u003C\u002Fcode>) is carried out by the root process instead of by the logged-in user. In the lab, an ordinary session used that to talk to a root-only Docker socket, got \u003Ccode>uid=0\u003C\u002Fcode>, and read \u003Ccode>\u002Fetc\u002Fshadow\u003C\u002Fcode>. Other variants replaced root-owned sockets and raced the path checks. One chain captured an enrollment key and joined a rogue machine to the tailnet, end to end only where Tailnet Lock was off. With Lock on, the researcher captured the material needed to disable it but didn't complete that step.\u003C\u002Fp>\u003Cp>The preconditions matter, so here they are plainly:\u003C\u002Fp>\u003Cul>\u003Cli>The attacker already controls one device in your tailnet. Tailworm does not get them in. The report itself says that foothold comes the usual ways: a vulnerable web app, a poisoned package, phishing, stolen credentials.\u003C\u002Fli>\u003Cli>That device has an SSH rule that lets it reach the target, with forwarding allowed. Windisch says on \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50227138&ref=ghost.jdneer.com\">Hacker News\u003C\u002Fa> that forwarding is on by default. On headscale 0.29.5 the code turns it on for every accepted session.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>So this is not remote code execution from the internet. It is privilege escalation and lateral movement inside a tailnet. The report calls it \"wormable\" because, in the lab, spread to every device the policy allowed took under a second per hop. Some readers on \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50227138&ref=ghost.jdneer.com\">Hacker News\u003C\u002Fa> pushed back hard on that word and on the report's length, and a Tailscale engineer there noted that its hosted control plane trims each node's peer list to what ACLs allow, which may differ from headscale. The report also covers app connectors reaching destinations the ACLs never approved (in the experimental conn25 feature), a \u003Ccode>tailscale serve\u003C\u002Fcode> path to the local admin API, and memory exhaustion bugs in headscale and the relay client.\u003C\u002Fp>\u003Ch2 id=\"where-tailscale-stands\">Where Tailscale stands\u003C\u002Fh2>\u003Cp>As of this writing there is no Tailscale \u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fsecurity-bulletins?ref=ghost.jdneer.com\">security bulletin\u003C\u002Fa>, no CVE and no fixed release for these findings. The latest release is still \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Freleases\u002Ftag\u002Fv1.104.2?ref=ghost.jdneer.com\">1.104.2\u003C\u002Fa>. Windisch wrote on \u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50227138&ref=ghost.jdneer.com\">Hacker News\u003C\u002Fa> that the issues were \"reported but not coordinated,\" so they went public before a fix existed. I think that was the wrong call, but it does not make the bugs less real.\u003C\u002Fp>\u003Cp>To Tailscale's credit, the response was fast. Mike Shaver, Tailscale's VP of engineering, wrote on Reddit, according to \u003Ca href=\"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Funpatched-tailscale-ssh-flaws-could-let.html?ref=ghost.jdneer.com\">The Hacker News\u003C\u002Fa>, that the company was already looking at these areas with outside specialists, is working on fixes, and is \"not recommending that everyone disable Tailscale SSH.\" The code backs that up. An open pull request, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Fpull\u002F21942?ref=ghost.jdneer.com\">#21942\u003C\u002Fa>, routes SSH forwarding through a helper that spawns a child process per operation, so sockets are dialed and bound with the logged-in user's credentials, \"never by root tailscaled.\" That is a similar privilege-drop approach to OpenSSH's. It targets a stacked development branch, not main, so it is still a work in progress. A separate \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Fpull\u002F21931?ref=ghost.jdneer.com\">fix\u003C\u002Fa> for one of the serve findings is already merged on the main branch. Neither has shipped in a release yet.\u003C\u002Fp>\u003Cp>It is also not the first time this exact area has bitten. Tailscale's own bulletins list TS-2026-004, where SSH Unix socket forwarding could be steered to a privileged socket through a symlink, and TS-2026-005, where Serve could be used by a non-root operator to proxy privileged sockets. Both were fixed in 1.98.9. Tailworm is, in large part, the next round of the same problem.\u003C\u002Fp>\u003Cp>To be fair about what this is: nobody broke WireGuard and nobody broke the crypto. This is a feature built on top of the tunnel, running with too much privilege. Which is exactly my point.\u003C\u002Fp>\u003Ch2 id=\"the-real-lesson-the-agent-is-the-attack-surface\">The real lesson: the agent is the attack surface\u003C\u002Fh2>\u003Cp>Look at what a modern mesh VPN agent does on every node. It runs as root or SYSTEM. It can be an SSH server, a port forwarder, a subnet router, an exit node, a web proxy and a file sharing tool. It takes its orders from a coordination server you probably do not run. It \u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Ffeatures\u002Fclient\u002Fupdate?ref=ghost.jdneer.com\">can update itself\u003C\u002Fa>. Every one of those features is useful, and every one of them is code running with full privilege on your most important machines.\u003C\u002Fp>\u003Cp>Now add the typical policy. Many tailnets start with \"everyone can reach everything\" and never get tightened, because it works and nobody complains. Put one compromised web server into that network and the mesh does the attacker's routing for them. One foothold plus a permissive ACL equals lateral movement. Tailworm just measured how fast.\u003C\u002Fp>\u003Cp>The convenience that makes these tools great is the same thing that makes them a perfect pivot. That is true of Tailscale, and it is true of every product in this category.\u003C\u002Fp>\u003Ch2 id=\"what-i-would-do-now\">What I would do now\u003C\u002Fh2>\u003Col>\u003Cli>\u003Cstrong>Turn off Tailscale SSH where you do not need it.\u003C\u002Fstrong> Run \u003Ccode>tailscale set --ssh=false\u003C\u002Fcode> on those hosts. Tailscale's \u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Ffeatures\u002Ftailscale-ssh?ref=ghost.jdneer.com\">own docs\u003C\u002Fa> warn you to make sure you have another way in first, so do that before you lock yourself out. Plain OpenSSH over the tunnel still works fine.\u003C\u002Fli>\u003Cli>\u003Cstrong>Kill forwarding where you keep it.\u003C\u002Fstrong> The report says forwarding can be denied per rule on Tailscale's hosted service, but Tailscale's \u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Freference\u002Fsyntax\u002Fpolicy-file?ref=ghost.jdneer.com\">public policy docs\u003C\u002Fa> don't document such a setting yet. Until they do, the host-side switch below or turning off Tailscale SSH is the dependable route. The 1.104.2 source has a \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Fblob\u002Fv1.104.2\u002Fssh\u002Ftailssh\u002Ftailssh.go?ref=ghost.jdneer.com#L54\">\u003Ccode>TS_SSH_DISABLE_FORWARDING\u003C\u002Fcode>\u003C\u002Fa> environment switch that blocks TCP and Unix socket forwarding in both directions, plus agent forwarding. It is read once at startup, so set \u003Ccode>TS_SSH_DISABLE_FORWARDING=1\u003C\u002Fcode> in \u003Ccode>\u002Fetc\u002Fdefault\u002Ftailscaled\u003C\u002Fcode> and restart the service. Because it is set on each node, it also works under headscale, where it is the only way to block forwarding. It is not in the public docs, so test it first.\u003C\u002Fli>\u003Cli>\u003Cstrong>Write least-privilege ACLs.\u003C\u002Fstrong> Per-pair SSH rules, one named source to one named destination, were the single control that stopped the spread in the lab. In practice, per-pair means a dedicated tag per server. Drop identity-wide and tag-wide accept rules, and never let a web server reach your management hosts just because it can.\u003C\u002Fli>\u003Cli>\u003Cstrong>Disable features you do not use.\u003C\u002Fstrong> Subnet routing, exit nodes, app connectors and serve forwards each add code paths with root behind them. If a node does not need a feature, turn it off on that node. The report also says to remove any \u003Ccode>tailscale serve --tcp\u003C\u002Fcode> forward that points at a Unix socket, especially \u003Ccode>tailscaled\u003C\u002Fcode>'s own.\u003C\u002Fli>\u003Cli>\u003Cstrong>Do not lean on check mode for this.\u003C\u002Fstrong> The Hacker News says Tailscale suggests enabling SSH check mode, but the report notes it does not stop the forwarding attacks, because forwarding happens after the session is approved.\u003C\u002Fli>\u003Cli>\u003Cstrong>Keep the agent off critical infrastructure.\u003C\u002Fstrong> If a site-to-site link or a management path can be a plain WireGuard tunnel terminated on a router or firewall, do that. I like RouterOS or VyOS for this. The tunnel ends on a box whose only job is routing, with a firewall policy you wrote, and no third-party daemon running as root on the servers behind it. That router then becomes the critical device to patch, and its management should stay off the WAN.\u003C\u002Fli>\u003Cli>\u003Cstrong>Consider self-hosted control where it fits.\u003C\u002Fstrong> \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fjuanfont\u002Fheadscale?ref=ghost.jdneer.com\">Headscale\u003C\u002Fa> keeps the coordination server under your own roof. Tailworm is a reminder that self-hosting is not a free pass, since headscale had its own findings and fewer knobs, so harden and patch it like any other exposed service.\u003C\u002Fli>\u003Cli>\u003Cstrong>Treat the agent like privileged software.\u003C\u002Fstrong> Inventory where it runs, watch its version, update it promptly, enable node-key expiry, and if a node is compromised, delete it at the control plane. The report notes that reimaging alone does not revoke keys an attacker already copied.\u003C\u002Fli>\u003C\u002Fol>\u003Cp>Mesh VPNs solved a real problem, and I am not telling anyone to rip them out. I am saying: stop thinking of the agent as plumbing. It is root on every box, with its own features, its own bugs and its own boss. Give it the least privilege and the fewest features it needs, and keep it away from the machines where one bad day would hurt the most.\u003C\u002Fp>\u003Cp>\u003Cem>Sources: \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Ftailworm.com\u002F?ref=ghost.jdneer.com\">\u003Cem>Tailworm report (Erica Windisch, Cyberdione Labs)\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fsecurity-bulletins?ref=ghost.jdneer.com\">\u003Cem>Tailscale security bulletins\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Fpull\u002F21942?ref=ghost.jdneer.com\">\u003Cem>tailscale\u002Ftailscale PR #21942\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Ftailscale\u002Ftailscale\u002Fpull\u002F21931?ref=ghost.jdneer.com\">\u003Cem>tailscale\u002Ftailscale PR #21931\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Ffeatures\u002Ftailscale-ssh?ref=ghost.jdneer.com\">\u003Cem>Tailscale SSH documentation\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Freference\u002Fsyntax\u002Fpolicy-file?ref=ghost.jdneer.com\">\u003Cem>Tailscale policy file reference\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Ftailscale.com\u002Fdocs\u002Ffeatures\u002Fclient\u002Fupdate?ref=ghost.jdneer.com\">\u003Cem>Tailscale auto-update docs\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=50227138&ref=ghost.jdneer.com\">\u003Cem>Hacker News discussion\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Funpatched-tailscale-ssh-flaws-could-let.html?ref=ghost.jdneer.com\">\u003Cem>The Hacker News\u003C\u002Fem>\u003C\u002Fa>\u003Cem>.\u003C\u002Fem>\u003C\u002Fp>","Tailworm shows Tailscale SSH forwarding can turn one hacked node into root on others. No CVE or patch yet. What it means for mesh VPN agents and what to do.",{"src":60,"height":73,"width":74,"type":75},1125,2000,"image\u002Fjpeg",{"name":77,"url":10,"owner":5},"JD Bungart",[79,91,102,111],{"slug":80,"title":81,"excerpt":82,"image":83,"publishedAt":84,"topics":85,"readMinutes":90},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[86,89],{"key":87,"label":88},"advisories","Advisories",{"key":67,"label":68},1,{"slug":92,"title":93,"excerpt":94,"image":95,"publishedAt":96,"topics":97,"readMinutes":90},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[98,101],{"key":99,"label":100},"guides","Guides",{"key":67,"label":68},{"slug":103,"title":104,"excerpt":105,"image":106,"publishedAt":107,"topics":108,"readMinutes":90},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[109,110],{"key":64,"label":65},{"key":67,"label":68},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":90},"insider-threat-lab-poisoning-cases","The Threat Was Already Badged In: Insider Lessons From Two Lab Poisoning Cases","A Wyoming grad student is accused of poisoning an officemate, and the internet already called it espionage. The charge says assault. What the court record actually shows, and the access, procurement, and reporting controls that would have caught it sooner.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Finsider-night-office-brunobd-unsplash.jpg","2026-10-25T14:00:00.000+08:00",[118,119],{"key":64,"label":65},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]