🚨 BREAKING: 11 UNPATCHED Security Flaws Exposed in Tailscale and Headscale. Researchers Demonstrate a Potentially WORMABLE Attack That Can Take Over Entire Server Networks. A new security report called Tailworm has revealed serious vulnerabilities in Tailscale, the widely used zero-trust networking platform. The most alarming finding? Researchers demonstrated how ONE compromised device could gain ROOT access to other servers across a private network in under a second per hop. Here's what researchers discovered: ➜ ROOT ACCESS: Tailscale SSH forwarding flaws reportedly allow an attacker with access to one authorized device to escalate privileges on other permitted servers, bypassing normal Linux user restrictions. ➜ WORM-LIKE PROPAGATION: In laboratory tests, exploitation spread automatically between permitted devices without additional passwords, SSH keys, or user interaction. ➜ CREDENTIAL THEFT: Attackers could potentially capture device enrollment credentials and register malicious machines as legitimate network members. ➜ CLOUD INFRASTRUCTURE EXPOSURE: A vulnerability in experimental app connectors could bypass network access restrictions, potentially exposing AWS cloud credentials, Kubernetes services, and internal infrastructure. ➜ SERVER DISRUPTION: Additional flaws in Headscale, the self-hosted alternative, could allow unauthenticated attackers to exhaust server memory and disrupt device registration. ➜ ADMINISTRATIVE TAKEOVER: Certain Tailscale Serve configurations could expose privileged local management interfaces to remote devices. 🚨 Why this matters: Tailscale is specifically designed to provide secure, private access to infrastructure without exposing servers directly to the internet. But these findings suggest that in vulnerable configurations, an attacker who compromises ONE authorized machine could potentially pivot across multiple servers with administrator-level access. And the vulnerabilities remain unpatched as of October 26. Security researcher Erica Windisch of Cyberdione Labs disclosed the findings after testing Tailscale v1.104.2 and Headscale v0.29.5. Tailscale has acknowledged related security issues and says fixes are underway. The company is NOT recommending that everyone disable Tailscale SSH. ⚠️ Important: The most serious attack requires an existing foothold and specific SSH permissions. This is not an unauthenticated attack against every Tailscale installation. The worm-like propagation was demonstrated in a laboratory, not observed in the wild. What administrators should do NOW: → Audit Tailscale SSH permissions and eliminate unnecessarily broad access rules. → Disable SSH forwarding if it isn't required. → Review app connector permissions and Tailscale Serve configurations. → Enable device key expiration and restrict access to sensitive servers. → Monitor Tailscale's official security updates for patches. 🔒 At Lucid Security, we're offering FREE website security reviews to help businesses identify exploitable vulnerabilities before attackers do. Request yours: lucidsecurity.si Full technical disclosure: tailworm.com/

🚨 BREAKING: Hackers are BYPASSING Microsoft 365 MFA, hijacking corporate accounts, and secretly replacing victims' authentication methods to maintain access. 97 accounts compromised across 79 organizations. In some cases, attackers took over sessions in just 12 MINUTES. And now, researchers have separately exposed a critical flaw in Microsoft Authenticator that allowed malicious apps to steal login tokens with ZERO permissions. Microsoft's authentication security is facing two serious threats, and one is already being exploited in the wild. Here's what's happening: 🔴 1. MICROSOFT 365 ACCOUNTS HIJACKED IN THE WILD Cybersecurity researchers at Huntress uncovered a widespread token-replay attack campaign targeting Microsoft 365. The numbers are alarming: → 200,000+ failed login attempts observed. → 497 successful sign-in events. → 97 compromised accounts across 79 organizations. → 48 rogue devices registered inside Microsoft Entra environments. → 19 organizations had victims' MFA methods removed and replaced. Attackers used sophisticated phishing techniques to capture legitimate authentication tokens AFTER victims completed MFA. They then replayed those tokens to access Microsoft 365 without another authentication challenge. But it gets worse. Once inside, attackers registered their OWN authenticator apps and devices to maintain persistent access. They also created hidden email rules to intercept or delete messages involving payroll, banking, and direct deposits. In one case, attackers hijacked a session just 12 MINUTES after the victim reached the MFA prompt and registered their own authenticator less than an hour later. Changing your password alone may NOT remove the attacker. 🔴 2. CRITICAL MICROSOFT AUTHENTICATOR TOKEN THEFT FLAW In a separate discovery, researchers at Enclave exposed CVE-2026-80097 (CVSS 8.6), a vulnerability allowing malicious Android apps to steal Microsoft authentication tokens. → ZERO Android permissions required. → No password required. → No additional MFA prompt. → Malicious apps could impersonate Microsoft Teams. → Stolen tokens could provide access to corporate email, files, calendars, and sensitive account functionality. The underlying flaw? Microsoft Authenticator trusted an application's claimed identity without properly verifying the actual caller. Microsoft has since patched this vulnerability. These are TWO separate security issues, with no confirmed connection between them. But they expose the same dangerous reality: 🚨 MFA ALONE IS NO LONGER ENOUGH TO STOP ATTACKERS WHO CAN STEAL OR REPLAY AUTHENTICATION TOKENS. And businesses relying entirely on MFA for protection may have a serious blind spot. 🛡️ IS YOUR BUSINESS EXPOSED? At Lucid Security, we're offering FREE security reviews to help businesses identify vulnerabilities, authentication weaknesses, and potential security gaps before attackers exploit them. Get your free security review: 🌐 lucidsecurity.si Sources: thehackernews.com/2026/10/mi… enclave.ai/blog/authmask-we-…