Cyber, in brief

Erica Windisch, a researcher at Cyberdione Labs, published a report called Tailworm on 25 October with 11 findings about Tailscale. [1]

Tailscale makes software that links an organisation's computers into one private network, run either by Tailscale's own service or by headscale, a version owners run themselves. [1]

The main finding: if one device on the network is already hacked, it can be used to get root, which means full control, on other servers it is allowed to log in to. [1]

It only works where Tailscale's remote login tool, Tailscale SSH, is set up to let a session pass traffic on to other services, a feature called port forwarding. [1]

Tailscale SSH does not ask for a password or key. It checks which device is connecting, and one access rule decides if that device may log in. [1]

The attack does not create the first break-in. The attacker must already control one device, through phishing, a stolen login or a poisoned software package. [1]

In a lab, Windisch says one hacked device spread to every device the rules allowed, in under a second per step, with no passwords and no user action. [1]

These are lab tests by one researcher, no one else has repeated them, and no attacks on real networks are known. [1]

Tailscale had published no security notice and no fixed version when the report came out. [1]

Mike Shaver, Tailscale's vice president of engineering, wrote that the company had found issues it is working to fix, but is not telling everyone to switch off Tailscale SSH. [1]

Windisch says she reported the problems but did not wait for Tailscale before publishing, and at least one commenter called that irresponsible. [1]

The report says rules that name one device and one target stopped the spread in its tests, and it urges owners to switch off forwarding where they can. [1]

Why it matters. The next thing that settles this is Tailscale's own security notice, which will say which setups are affected and which version fixes them; until it appears, the only protection is how owners set up their rules. [1]

Palo Alto Networks, a security company, says attackers used the PHP2Shell flaws to break into a European government body. [2] Within two hours they had its scrambled passwords and the secrets behind its second login check. [2] PHP is the code behind about 70% of websites. [3] On 22 October Britain's cyber agency said it knew of no successful hacks, and that older systems the fix cannot reach must be replaced. [3] CYFIRMA, a security firm, says a group it links to North Korea is probing 216 servers that are not fully protected in 11 countries and the EU. [2]

Why it matters. After getting in, the attackers tried to take over the body's whole network, which shows how far one unpatched server can lead. [2] The probing is aimed at government offices, banks, airports, factories and shopping sites. [2]

Quentin Kaiser, a researcher in Belgium, showed on 16 October that a flaw in Broadcom's Wi-Fi setup code lets someone within radio range take over a router. [4] Broadcom's code sits in routers and Wi-Fi points from dozens of brands, and he estimates millions of devices are affected. [4] He made it work on home routers given out by Proximus and Orange Belgium, two internet providers. [4] Kaiser says Broadcom has known since 2018 and shipped only a partial fix, and on older chips no working fix was ever shipped. [4]

Why it matters. There is no patch for households to install, and on older chips replacing the router is the only fix Kaiser offers. [4] He published free tools that let anyone check router software for the flawed code. [4]

SOCRadar, a security research firm, found an exposed server used by partners of the INC and The Gentlemen ransomware gangs. [5] Its logs showed AI tools carrying out break-ins while a person approved each step, across 8,257 messages. [5] When an AI model refused, the operator told it the job was an authorised security test. [5] About 62 organisations were targeted, more than half in the US, and four were later named on the gangs' leak sites. [5]

Why it matters. In one case a single reused password let them into a victim's VPN, servers, backups and security tools at once, SOCRadar says. [5] Factories and energy firms were targeted most, then healthcare and drug companies. [5]

Forever Security, a company that watches for risks from AI tools, found a planted instruction file called AGENTS.md in a customer's Downloads folder. [6] AI coding tools read such files to learn how to work in a folder, and this one told the tool to install a harmful software package. [6] In tests it got Codex, OpenAI's coding tool, to run a harmless stand-in program 90% of the time. [6] A similar file tricked Claude Code, made by Anthropic, into leaking its login token. [6]

Why it matters. The researchers say there is nothing for OpenAI or Anthropic to patch, because the tools are doing what they were built to do. [6] OpenAI and Anthropic advise starting these tools inside the one project folder they should work on. [6]

PwC, one of the world's biggest accounting firms, said on 23 October that an outside company hosting its staff training records had a security incident. [7] A day earlier an extortion gang called Everest claimed it had taken 590 gigabytes of PwC data. [7] Everest posted a countdown of five days and said it would publish the data unless a deal is reached. [7] PwC says no client data, sensitive personal data or financial details were on the site. [7]

Why it matters. Everest says the files hold staff names, emails, phone numbers and job histories, which PwC has not confirmed or denied. [7] Its countdown runs out around 27 October. [7]

Two US Marines, one serving and one former, filed a class action against the US Defense Department on 19 October. [8] They say a break-in last year at its personnel records office exposed Social Security numbers and birth dates for months. [8] They want to speak for more than three million service members and seek over $5 million. [8] The lawsuit says intruders used a flaw in a file-sharing system that held unencrypted records. [8]

Why it matters. Neither the US Defense Department nor the Marines' lawyers answered Reuters at first. [8] In 2022 the US Office of Personnel Management paid $63 million to settle a similar case over federal staff data. [8]

John Crain, chief technology officer of ICANN, which runs the internet's address system, said work to protect it from future quantum computers is speeding up. [9] Such computers could one day break the codes that prove an address is genuine. [9] Crain said the address system may need to be ready in three to five years, not the ten he once expected. [9] Bigger codes make the system's small messages too large, and changing how they are sent will take a few years, he said. [9]

Why it matters. ICANN, the IETF and other bodies that set the internet's technical rules have begun early work on the change. [9] ICANN also found that web endings for regulated trades, like .bank, have a 45% higher chance of abuse by scammers. [9]

Mave, a security start-up in Tel Aviv founded in 2025 by former members of Unit 8200, an Israeli military intelligence unit, has raised $34 million in total. [10] That is $6 million from its first round plus a new $28 million led by Red Dot Capital Partners, announced on 22 October. [10] Mave builds AI programs that gather alerts from a company's security tools and explain them to the team. [10] It has about 30 staff. [10]

Why it matters. Mave says security teams cannot keep up with attackers who use AI, so defenders need AI too. [10] For now it keeps a person approving actions instead of letting its AI act alone. [10]

Pakistan's National Cyber Crime Investigation Agency said on Sunday that it had broken up an international network selling videos of child sexual abuse. [11] It says the suspected leader, from Skardu in the north, was arrested with help from foreign agencies. [11] The videos were sold in secret Telegram groups for cryptocurrency, the agency says, and one suspect is a father accused of filming his own young children. [11] Raids to arrest others are continuing. [11]

Why it matters. These are the agency's claims at a press conference, and no court has tested them yet. [11] The same officials described a separate gang that befriended children aged 6 to 14 on Instagram and sold videos through WhatsApp groups. [11]