Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
2026-10-26T01:24:00Z•595ae4b5d68d31120bb6a073b2d31afa413cd9d2d3a6ce6f0b1251297a1acc54
CVE-2026-109618CVE-2026-109619CVE-2026-110447CVE-2026-111497CVE-2026-112900CVE-2026-115560AI-assisted attacksArista VeloCloudBrotliCISA KEVCollabora OnlineGitHub tokensKSMBDLinuxNode.jsPHPPillowRCESecure BootUEFI bootkitVPNactive exploitationcredential theftdata breachfirewallsransomwareremote code executionsupply-chain compromisezero-day
What happened
The feed reports a broad set of significant cybersecurity developments, including actively exploited critical vulnerabilities, zero-days, remote code execution flaws, supply-chain compromises, credential theft, ransomware operations, UEFI bootkits, and AI-assisted intrusions. Particularly urgent items include PHP2Shell exploitation, Brotli decoder RCE affecting Node.js and other software, actively exploited Collabora Online and Arista VeloCloud flaws, Pillow command execution, and exposed firewall/VPN credentials.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 595ae4b5d68d31120bb6a073b2d31afa413cd9d2d3a6ce6f0b1251297a1acc54
- Enrichment time
- 2026-10-26T01:24:00Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.