#Node2Shell

Mark Gadala-Maria @markgadala

🚨 BREAKING: 11 UNPATCHED Security Flaws Exposed in Tailscale and Headscale. Researchers Demonstrate a Potentially WORMABLE Attack That Can Take Over Entire Server Networks. A new security report called Tailworm has revealed serious vulnerabilities in Tailscale, the widely used zero-trust networking platform. The most alarming finding? Researchers demonstrated how ONE compromised device could gain ROOT access to other servers across a private network in under a second per hop. Here's what researchers discovered: ➜ ROOT ACCESS: Tailscale SSH forwarding flaws reportedly allow an attacker with access to one authorized device to escalate privileges on other permitted servers, bypassing normal Linux user restrictions. ➜ WORM-LIKE PROPAGATION: In laboratory tests, exploitation spread automatically between permitted devices without additional passwords, SSH keys, or user interaction. ➜ CREDENTIAL THEFT: Attackers could potentially capture device enrollment credentials and register malicious machines as legitimate network members. ➜ CLOUD INFRASTRUCTURE EXPOSURE: A vulnerability in experimental app connectors could bypass network access restrictions, potentially exposing AWS cloud credentials, Kubernetes services, and internal infrastructure. ➜ SERVER DISRUPTION: Additional flaws in Headscale, the self-hosted alternative, could allow unauthenticated attackers to exhaust server memory and disrupt device registration. ➜ ADMINISTRATIVE TAKEOVER: Certain Tailscale Serve configurations could expose privileged local management interfaces to remote devices. 🚨 Why this matters: Tailscale is specifically designed to provide secure, private access to infrastructure without exposing servers directly to the internet. But these findings suggest that in vulnerable configurations, an attacker who compromises ONE authorized machine could potentially pivot across multiple servers with administrator-level access. And the vulnerabilities remain unpatched as of October 26. Security researcher Erica Windisch of Cyberdione Labs disclosed the findings after testing Tailscale v1.104.2 and Headscale v0.29.5. Tailscale has acknowledged related security issues and says fixes are underway. The company is NOT recommending that everyone disable Tailscale SSH. ⚠️ Important: The most serious attack requires an existing foothold and specific SSH permissions. This is not an unauthenticated attack against every Tailscale installation. The worm-like propagation was demonstrated in a laboratory, not observed in the wild. What administrators should do NOW: → Audit Tailscale SSH permissions and eliminate unnecessarily broad access rules. → Disable SSH forwarding if it isn't required. → Review app connector permissions and Tailscale Serve configurations. → Enable device key expiration and restrict access to sensitive servers. → Monitor Tailscale's official security updates for patches. 🔒 At Lucid Security, we're offering FREE website security reviews to help businesses identify exploitable vulnerabilities before attackers do. Request yours: Full technical disclosure:

Salman Khan @salmanite

PHP2SHELL Exploit 🔥🔥🔥 🚨 XHack AI CoHunters successfully reproduced Remote Code Execution (RCE) in PHP 8.4, TWICE! Two autonomous AI CoHunters collaborated to develop and validate a working exploit chain in a controlled Docker lab. #php2shell #bughunting #xhack

Aikido @AikidoSecurity

Evolving threat 🚨 CVE-2026-111497, previously known to affect Node.js (node2shell) and Python has evolved into “HTTP2Shell.” A significant blast radius. This vulnerability leaves many libraries and applications using HTTP vulnerable to pre-auth RCE via Brotli decompression. Please be aware. Fixes not yet available for all affected services. Look for Brotli (1.2.1) dependency upgrades when they become available.