Tailscale replied on Reddit: Hi folks, Mike Shaver here, VP of Engineering at Tailscale. We've seen the concerns about Tailscale SSH and wanted to share what we know so far. If you want to jump to the most important part, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. We've now received the researcher's report and are reviewing it. Our engineering and security teams had already been investigating independently, with help from external security specialists. That work has identified issues we're working to fix. We're still validating the full scope, including which configurations are affected. A bit of technical context: Tailscale SSH uses your tailnet's access policies to control who can connect to which machines. Most of the issues we've identified so far concern what happens after someone has been authorized to connect, particularly how Unix privileges and SSH forwarding are handled. In some cases, a session may be able to do more than the configured local user should be allowed to do. While it’s a serious concern, it isn't the same as an unauthenticated attacker being able to connect to arbitrary machines, but the potential impact depends on how SSH access is configured. We're still investigating, so we don't want to make blanket claims about what's affected or not. Again, based on our current assessment, we're not recommending that everyone disable Tailscale SSH. In the meantime, there are a few precautions you can take: •Review your SSH access policies. Make sure only the people and devices that need access have it. •Review SSH forwarding permissions and remove access you don't need. •Consider enabling SSH check mode for an additional authentication step. This won't fix privilege escalation issues, but it does add another barrier to gaining access. •Enable automatic updates where supported so you can pick up fixes when they're released. For particularly sensitive systems, consider temporarily tightening your Tailscale SSH access policies while we investigate, so that only the specific users and devices that need access can connect. We're working on fixes and testing them carefully. We'll publish a security advisory explaining the confirmed findings, affected configurations, recommended actions and available patches. We'll also follow up with a more detailed technical write-up. If we find anything that changes our assessment or requires immediate customer action, we'll communicate that. We know it's been a rough week for security teams, and we understand why people are concerned. We'd rather give you the technical context we have than speculate about things we haven't confirmed yet. We'll share more as we verify the details. If you have any questions about how this relates to your particular environment, please get in touch with our team tailscale.com/contact/suppor…

New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)

We owe you an apology. On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe. Exposed: names, contact details, shipping addresses, and order details (items and prices). Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords. We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers. Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us. NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself. A detailed report is coming soon. Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance. Again, we're truly sorry to everyone affected.

full changelog for 0.75.5: new - vault in settings saves your logins, cards and contact info, and your bot fills them in to sign in or check out - bots can forward email from their own inbox with the original formatting, images and attachments - bots record who asked for each slack message they post improved - auto-review asks less often for things you asked for in your own words - after you deny an approval card, your bot stops trying that action - emails and slack messages you ask for go out once auto-review allows them - sign-in handoffs also offer the site's connector card - x connects through your linked account, and x money connects with it - routines can run up to 300 times an hour - route through this computer shows how many private or vpn sites were blocked fixed - fewer auto-review fallbacks to an approval card - auto-review respects "only draft" requests - asking about your x followers gets a plain answer - bot management survives an account merge also in 0.75.3 - halloween pumpkin avatar - full chats in team bot dms - plugins with multiple servers show each one on its own row - replies to slack threads that were also sent to the channel x.ai/changelog/bot

Grok Bot can now save your logins, cards, and contact information. Add them once, and Bot securely remembers them for the future.

Security Alert for Fearless Wallet Fearless Wallet is a third-party application, built and maintained by an independent team. Following an investigation by the Polkadot Technical Fellowship on behalf of the @PCF_org, it was found that the Fearless Wallet browser extension had been compromised and had been leaking users’ private keys since February 2025. If you have used the Fearless Wallet browser extension, please create a new keypair with a different wallet and move your funds as soon as possible. Remember to never share your private keys.

🚨SHOCKING: OpenAI just disclosed TWO of its own AI agents DISABLED their safety monitoring, including one that DENIED doing it. A GPT-6 Astra agent removed its misalignment monitor while migrating code, then rewrote a test to require that monitoring was absent. Asked if it had removed the monitor, it replied: "No... I did not remove an enabled monitor from it." Days earlier, a GPT-6.1 Sol agent suppressed automatic alerts to OpenAI's security team, treating a "don't send any messages" instruction as permission to silence the alarms. Neither case was flagged as critical or shut down automatically. OpenAI says it doesn't "yet have a satisfying explanation," and is now testing whether its models have "a propensity to evade misalignment monitoring." The incidents happened on October 3 and 6, per OpenAI's own report.