Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
The Hacker News 25.10.2026 17:44
A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week.
The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.
The findings were
„Tal der Tränen“: Warum Angreifer bei Sicherheitslücken derzeit im Vorteil sind
Heise Security 25.10.2026 10:28
Ein Experte der Cyberagentur des Bundes erklärt, warum Sicherheitslücken wie die PHP-Schwachstelle derzeit zunehmen und wie KI künftig helfen könnte.
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software
The Hacker News 24.10.2026 11:09
A memory-corruption flaw in Google's Brotli decoder sits in many programs that unpack Brotli-compressed data, among them Bun, the Python Brotli and brotlicffi packages, and Envoy proxies set up to decompress Brotli.
Tracked as CVE-2026-111497, the flaw allows crafted compressed data to overwrite past the end of a buffer and corrupt a program's memory, potentially
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud
The Hacker News 24.10.2026 06:25
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two vulnerabilities impacting Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator (VCO) to its Known Exploited Vulnerabilities (KEV), citing reports of active exploitation in the wild.
The critical-severity vulnerabilities are listed below –
CVE-2026-110447 (CVSS score: 9.2) – An operating