Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
2026-10-25T19:23:59Z•239612c68121577394e4a0aa3035504c2c6a6fde5e0935b4450f72111b213b82
CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-111497CVE-2026-112900CVE-2026-115560AI-securityBrotliCollabora-OnlineLinux-KSMBDLiteLLMMiraiNode.jsPHPPillowUEFI-bootkitVeloCloudactive-exploitationcredential-theftdestructive-attackransomwareremote-code-executionstate-sponsoredsupply-chain-compromisevulnerabilityzero-day
What happened
The document aggregates cybersecurity news covering actively exploited vulnerabilities, critical remote-code-execution flaws, supply-chain compromises, credential theft, ransomware operations, AI-agent security risks, bootkits, and destructive state-sponsored attacks. Key incidents include exploitation of PHP2Shell flaws, a Brotli decoder memory-corruption vulnerability affecting Node.js and other software, Pillow EPS command execution, actively exploited Collabora Online and Arista VeloCloud flaws, a leaked LiteLLM master key enabling a malicious package release, and credential theft from VPN
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 239612c68121577394e4a0aa3035504c2c6a6fde5e0935b4450f72111b213b82
- Enrichment time
- 2026-10-25T19:23:59Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.