ALvantages

researcher Erica Windisch is calling it "Tailworm" and i don't think people realize how serious this is in 3 days of testing there have been 11 Tailscale flaws found in her lab and made public before any fix. not in a year. not in a month. in 3 days the worst ONE of these would normally be big news on its own Tailscale SSH: in her lab, one hacked device with SSH access got full control (root) of another server in 0 seconds. it checks the device, never a user password rogue device: in her lab she stole the key that lets new machines join the private network, then added her own device under the victim's identity the worm: in her lab it spread on its own to every device the access rules allowed. under a second per jump. no passwords. no stolen keys experimental app connectors: an approved user could send traffic anywhere the connector can reach, even to cloud server credentials and every Kubernetes service. the network rules never checked the real destination headscale: if this free self-run server for Tailscale is open to the internet, anyone with no account can crash it. 1,024 tiny sign-ups stop new devices from joining tailscale serve: one line of setup can open a device's admin controls to other devices on the network and that's not the whole list she didn't wait for Tailscale to fix them. she says "infrastructure is vulnerable today". 6 of the 11 are rated high severity her report says the network turns one ordinary break-in into admin access across all your machines "at machine speed" if you use Tailscale SSH, run your own headscale server, or use the experimental app connectors you are potentially affected turn off SSH forwarding. give SSH access one device pair at a time. make device keys expire. lock down app connectors 11 flaws are public now, and Tailscale hasn't posted a security bulletin about them yet follow me if your company runs on Tailscale. i'm tracking all 11 until they're fixed