Vulnerabilities & remediation
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
The Hacker News reports: A single hacked device on a Tailscale network can be used to gain root access to other servers it can reach, according to a security researcher who published the findings this week. The attack requires two things: Tailscale SSH set up to allow port forwarding, and an attacker who already controls one device that the network's access rules permit to connect to the target.
Vulnerabilities & remediation
PHP2Shell Exploitation Attempts Continue Amid Suspected N. Korea Global Scanning Activity
The Hacker News reports: In an update, Palo Alto Networks Unit 42 said it's retracting its earlier assessment that the post-compromise activity targeting the European government agency involved the exploitation of the PHP2Shell flaws.
Security Operations
YARA-X 1.22.0 Release, (Sun, Oct 25th)
SANS Internet Storm Center reports: YARA-X&#;x26;#;39;s 1.22.0 release brings 11 improvements and 9 bugfixes.
AI & Security
AI coding agents hijacked using AGENTS.md file in Downloads folder
BleepingComputer reports: Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package.
AI & Security
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication
The Hacker News reports: OpenAI has announced plans to conduct frontier model training with no live internet access, as it resumes reinforcement learning (RL) training and internal inference of its most advanced AI models.