Four developer stories from Wednesday, October 28, 2026, each read from its own primary source. The lead is Tailscale SSH and the report called Tailworm: a researcher said an authorized SSH session could reach sockets only root should touch, and Tailscale shipped fixes in version 1.104.4. The video has the full walkthrough; this article keeps the quotes, numbers and links in one place.
TL;DR
- Tailscale says its SSH server ran Unix socket forwarding as root after checking paths by their text. Fixes are in Tailscale 1.104.4. Until you update, the documented setting
TS_SSH_DISABLE_FORWARDING=1turns forwarding off without turning SSH off. - A researcher site says git, curl and python on macOS still accept certificates from the compromised eMudhra intermediates. Apple's own support page describes why: command line tools read
/etc/ssl/cert.pemand skip Apple's block until a future update. - Discord says every Discoverable Server gets a public web page on November 16, 2026, and messages from admin-allowed public channels can appear in web search from mid-December 2026. Controls are live now.
- The Stanford Daily reports that professors who opted out of the $1.5 billion Bartz settlement are suing Anthropic separately. The claims are allegations, and no ruling on them was found.
Tailscale SSH Tailworm: what the report found
The report is called Tailworm. It was written by Erica Windisch of Cyberdione Labs, who tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24. Tailscale says it received the report on the morning of Saturday, October 24, and the researcher published it two hours later. Tailscale had already started investigating after concerns circulated on Friday, October 23, and published an investigation update on Monday, October 26.
The finding that matters most to anyone running Tailscale SSH is about socket forwarding. Tailscale's own bulletin says the SSH server in the root-privileged tailscaled process "validated Unix socket paths lexically but would perform the operations as root." That created three problems. Local forwarding (ssh -L) allowed privileged dials. Remote forwarding (ssh -R) allowed socket replacement by unlinking root-owned sockets. And a race condition defeated the path allowlist, because the kernel re-resolves paths after the initial check.
The bulletin names what an attacker could reach: root-only sockets such as the Docker socket or the tailscaled local API. Tailscale's fix performs Unix socket forwarding on behalf of the authenticated user rather than as root. The same release addresses other items in the four bulletins numbered TS-2026-014 through TS-2026-017, including memory exhaustion in SSH session handling that could take down tailscaled, and Tailscale Serve issues.
What Tailscale says an attacker needs
Tailscale's findings post says exploitation requires an existing foothold on an authorized peer in the tailnet, with SSH access explicitly permitted in the tailnet policy file, along with the conditions for the vulnerable feature. For the forwarding bulletin that means SSH with local or remote forwarding allowed in the access policies. It says the issues do not let an unauthenticated attacker connect to arbitrary Tailscale SSH servers.
On the name, Tailscale writes that the report "prompted questions about whether these vulnerabilities constitute a computer worm" and that they "don't describe self-replicating malware." It calls the path lateral movement limited to connections the tailnet policy file already allows. The researcher's page takes a different view of the engineering choices and says the flaws were discovered with low effort. Both statements are on the record; the fix is out either way.
Tailscale 1.104.4: update, or turn forwarding off
If you use Tailscale SSH, update to 1.104.4 or newer. If you cannot update today, the bulletin documents setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting the service. Tailscale also suggests reviewing SSH access policies and using check mode for sensitive systems, and its earlier update said it was not recommending that everyone disable Tailscale SSH.
macOS git, curl and the eMudhra certificates
On October 21 the episode covered the eMudhra intermediate certificate keys and ended on a request to check the deployed client's trust. A researcher site run by Dennis Jackson, with community contributors, now says Apple was notified on October 17 and that, as of October 28, the developer tools Apple ships with macOS, including git, curl and python3, still trust the compromised certificates. It also says macOS 27.2, released on October 26, did not fix the issue and undid the workaround users had applied by hand. Those are the site's claims.
Apple's support page, "About the compromised eMudhra intermediate CAs", agrees on the structure. Since October 19, Apple has blocked the certificates in Safari, Mail and apps that use Apple's networking and security frameworks. But "some tools included with macOS or the Xcode Command Line Tools — like curl and git — check certificates against /etc/ssl/cert.pem and can still accept these certificates until a future software update." The page lists curl, git, python3, ruby, perl and openssl, gives optional manual steps that remove up to two root certificates from that file, and warns that removal can break verification of some websites and that a macOS update can replace the file. I found no fix date on the page.
Tailscale's own bulletin on these keys, published October 21, explains why this matters beyond the Mac command line: its client accepts any TLS connection signed by a certificate trusted by the system certificate store. For developers the practical steps are the researchers' check against your own git, the same check on any Mac CI runner, and a repeat after each macOS update until Apple ships its fix.
Discord Server Web Pages: dates, defaults and opt-outs
Discord's October 27 blog post says Discoverable Servers, the most public kind with at least 1,000 members, number more than 63,000. From November 16, 2026 every one of them has a public Server Web Page, with a default page generated from the Server Profile if admins have not set one up. Automated Channel Summaries can start appearing the same day. From mid-December 2026, messages from public channels may appear on those pages and in web search, without usernames or avatars, if the server's admins allow it. Messages sent before then are not included.
The defaults decide the outcome. If admins change nothing, public channels stay on. Admins choose channels in Server Settings under Web Presence. Members have one switch in User Settings under Data and Privacy that covers Channel Messages in every Discoverable Server. It is off by default in the EU, UK, Canada, Brazil, Australia and South Korea, and teen accounts are excluded. Two details are easy to miss: Channel Summaries are generated separately and stay unless admins turn them off, and a message sent while the switch was on stays up unless you delete it.
Authors, Anthropic and the Bartz settlement
The Stanford Daily reported on October 27 that Stanford professors including Tobias Wolff opted out of the Bartz v. Anthropic settlement and are suing Anthropic separately. The settlement, which the Daily says covers nearly 500,000 registered works for $1.5 billion, works out to about $3,000 per work. The opt-out suit, according to the Daily, seeks a jury trial, statutory damages of up to $150,000 per work, which is fifty times more, and a permanent injunction against training on the plaintiffs' books. Our October 26 episode covered the $1.5 billion figure in Anthropic's filing.
The Daily's headline states the claim as settled. The ruling underneath is narrower: the Daily summarizes Judge William Alsup as finding that training on legally acquired books was fair use and that building a permanent central library from pirated copies was not. The new suits allege pirated copies from shadow libraries. I found no ruling on their claims, and Anthropic's response was not part of the article. On September 27 the OpenAI LibGen files raised the same sourcing question about another lab. For anyone assembling training data, the useful habit is a record of where each file came from.
Verdict: NEEDS REVIEW
Tailscale's fix is out but your servers may not be updated. Apple's command line gap is still open. Discord's defaults switch on November 16. The authors' claims are still allegations. Read the primary posts below and check your own systems.
Sources
- https://tailscale.com/blog/tailscale-ssh-findings-fixes
- https://tailscale.com/ssh-investigation-update
- https://tailscale.com/security-bulletins
- https://tailworm.com/
- https://news.ycombinator.com/item?id=50264857
- https://emudhra.we-have-a-problem.com/apple.html
- https://support.apple.com/en-us/149555
- https://news.ycombinator.com/item?id=50271640
- https://discord.com/blog/making-content-from-discoverable-servers-easier-to-discover
- https://stanforddaily.com/2026/10/27/professors-books-pirated-to-train-claude/
This article expands on an episode of **The Daily Diff, a five-minute daily video on what shipped and what broke in tech.
Watch the episode · Subscribe on YouTube · the written diff lands in your inbox every morning at thedailydiff.dev.
Top comments (1)
The check-by-path, act-as-root gap is a classic time-of-check/time-of-use shape, and it's a good reminder that an allowlist on a path string means little once the kernel re-resolves it. For teams that can't update immediately, TS_SSH_DISABLE_FORWARDING=1 is a nice narrow mitigation because SSH access itself keeps working. It's also worth asking whether the Docker socket should be reachable by anything that gets a shell on the host, since that socket is effectively root on the machine.