#vpn

Tailscale, a popular VPN-style networking service, released client version 1.104.4 to fix four security bulletins in Tailscale SSH and related features, after a researcher, Erica Windisch of Cyberdione Labs, published a report called Tailworm, The Hacker News reports.

The main flaw was in socket forwarding: the server checked a path and then acted as root, and a timing trick could swap the path in between. An attacker who already controls a device allowed to open SSH sessions could reach root-only sockets such as Docker's, which in Windisch's tests gave a root shell. Tailscale says the flaws do not let an unauthenticated attacker connect to arbitrary servers. The fix runs forwarding as the logged-in user.

Tailscale recommends updating, tightening SSH access rules, and, where an update must wait, setting TS_SSH_DISABLE_FORWARDING=1, which it says blocks several of the more serious findings without turning off Tailscale SSH.

The FBI warns that attacks using the FortiBleed credentials leak are ongoing against exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers log in with leaked or stolen credentials, crack further password hashes offline, and in some cases create their own admin accounts and delete or change the legitimate ones. The FBI says the attack chain has been an entry point for ransomware affiliates. It says fixing this may take more than patching and resetting passwords: restrict external access, end all active VPN sessions, enforce MFA and review logs.