# tailscale Published articles for tailscale. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Tailscale Part 3: Make Remote Access Easier With MagicDNS DevFeed: [Tailscale Part 3: Make Remote Access Easier With MagicDNS]() Original publisher: [Read original article]() Author: Jeremy Published: 2026-11-08T13:31:15Z Content type: tutorial Language: en Sources: [Noted]() Topics: [tailscale](), [Domain Name System (DNS)]() Tags: [dns](), [dns-configuration](), [docker](), [homelab](), [http](), [internet-traffic](), [tailscale]() ### AI overview Tailscale MagicDNS creates DNS records for devices on a tailnet, letting you connect by machine name instead of remembering Tailscale IP addresses. It is enabled by default on tailnets created after October 20, 2022; check the DNS section of the administration dashboard to confirm. Devices receive a fully qualified name under the tailnet's `.ts.net` domain, and shorter machine names usually work from another device on the same tailnet. You can rename a device in the Machines dashboard, and MagicDNS updates its record automatically. Test by pinging a device name or opening a service URL such as `http://homelab-server:3000`. MagicDNS names Tailscale devices; it does not automatically name Docker services or devices reachable only through subnet routing, which may need additional DNS configuration. ### Source excerpt Tired of remembering IP addresses? Learn how Tailscale MagicDNS lets you access your homelab using simple device names instead. ## Tailscale Part 2: Access Your Entire Homelab With Subnet Routing DevFeed: [Tailscale Part 2: Access Your Entire Homelab With Subnet Routing]() Original publisher: [Read original article]() Author: Jeremy Published: 2026-11-07T12:27:19Z Content type: tutorial Language: en Sources: [Noted]() Topics: [tailscale](), [Homelab](), [Network Configuration](), [CIDR and subnets](), [IP routing]() Tags: [firewall](), [gateway](), [home-network](), [homelab](), [ip](), [ipv4](), [linux](), [nas](), [routing](), [subnet](), [tailscale]() ### AI overview Tailscale subnet routing lets one always-on Tailscale-connected Linux server act as a gateway to homelab devices that do not run Tailscale, using their existing local IP addresses. Enable Linux IP forwarding, advertise the home subnet with `tailscale set --advertise-routes`, then approve the route in the admin dashboard unless automatic approval is configured. Tailnet access policies must permit connections; on Linux clients, enable route acceptance with `tailscale set --accept-routes`, while phones and Windows devices normally pick up approved routes automatically. Access still depends on the gateway being available and routing and firewall settings allowing the connection. ### Source excerpt Learn how Tailscale subnet routing lets you securely access your entire homelab remotely without installing Tailscale on every device. ## Getting Started with Tailscale: Secure Remote Access to Your Homelab DevFeed: [Getting Started with Tailscale: Secure Remote Access to Your Homelab]() Original publisher: [Read original article]() Author: Jeremy Published: 2026-11-06T12:34:59Z Content type: tutorial Language: en Sources: [Noted]() Topics: [tailscale](), [Homelab](), [Virtual Private Network](), [ssh](), [network security]() Tags: [dashboard](), [encrypted-traffic](), [encryption](), [firewall](), [home-network](), [homelab](), [http](), [installation](), [ip](), [remote-access](), [tailscale](), [vpn]() ### AI overview Tailscale lets authorized devices reach homelab services through a private tailnet, using WireGuard encryption and attempting direct connections while relaying encrypted traffic when needed. The article's Linux example is to create an account, install Tailscale, run `sudo tailscale up`, authenticate in a browser, and get the server address with `tailscale ip -4`; install the app on a phone and sign in with the same account to test access over mobile data. This avoids opening router ports, though access still depends on the service accepting connections on the relevant interface and the firewall permitting them. The text also notes that subnet routing can extend access to devices without Tailscale installed, but defers its setup to a later article. ### Source excerpt Learn how Tailscale makes it easy to securely access your homelab from anywhere without opening ports or configuring a traditional VPN. ## Why I Ditched Google Drive for Syncthing and Tailscale DevFeed: [Why I Ditched Google Drive for Syncthing and Tailscale]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-11-06T08:05:45Z Content type: article Language: en Sources: [HackerNoon]() Topics: [tailscale](), [Synology]() Tags: [about](), [actions](), [all](), [allows](), [also](), [announcement](), [app](), [apply](), [apps](), [database](), [drive](), [google](), [google-drive](), [hackernoon-top-story](), [i](), [keepass-xc](), [password](), [privacy](), [private](), [secure-file-sync](), [sync](), [synchthing](), [syncthing](), [synology](), [tailscale]() ### AI overview The author replaced Google Drive for a KeePass database after KeePassium sometimes kept pointing to an old file when KeePassXC replaced it during saves. Syncthing now syncs the `.kdbx` file among a laptop, phone, iPad and always-on Synology NAS, with Tailscale providing stable private addresses. On the NAS and Mac, the author disables Syncthing discovery, relaying and NAT traversal; the NAS keeps recent file versions. The iOS app Sync Anything cannot disable discovery or relaying, and iOS background limits mean sync may lag, so the author opens it before KeePassium after password changes. Offline edits can create conflict copies, which KeePassXC can merge. The NAS-centered setup stops syncing when the NAS is down, and its version history is not backed up; current copies remain on the other devices. The author currently syncs only the password database and leaves other files on Google Drive. ### Source excerpt Tired of Google Drive sync issues? Here's how I built a private password database sync system using Syncthing, Tailscale, and Synology. ## I got tired of remembering ports for 30 Docker apps in my homelab. Here's how I fixed it DevFeed: [I got tired of remembering ports for 30 Docker apps in my homelab. Here's how I fixed it]() Original publisher: [Read original article]() Author: Anne Barela Published: 2026-11-04T16:58:29Z Content type: article Language: en Sources: [Adafruit Industries]() Topics: [tailscale](), [Docker](), [Homelab]() Tags: [docker](), [github](), [go](), [homelab](), [projects](), [software](), [tailscale]() ### AI overview Tailscale Services lets the author reach homelab apps by service name instead of remembering each machine's IP address and port. A Service has a name and virtual IP on the tailnet and can be advertised by tagged machines; access rules can target an individual Service, allowing Jellyfin to be shared without exposing its whole host. Setting this up manually requires a tagged host, a policy with an auto-approver, and a service definition and serve command for each app. The author found that cumbersome across about 30 containers, with configuration split between Docker Compose and the admin console, and wrote DockTail, an AGPL-3.0 Go program that watches Docker events and turns container labels into Services. ### Source excerpt A community writer at It's FOSS runs a homelab of 5 machines and about 30 Docker containers, and got tired of a bookmarks folder full of IP addresses and port numbers. Tailscale got them into the network from anywhere, but once inside they still had to remember which box ran what. Tailscale Services gave them [...] ## I Got Tired of Remembering Ports for 30 Docker Apps in My Homelab. Here's How I Fixed it DevFeed: [I Got Tired of Remembering Ports for 30 Docker Apps in My Homelab. Here's How I Fixed it]() Original publisher: [Read original article]() Author: Community Published: 2026-11-04T06:36:35Z Content type: tutorial Language: en Sources: [It's FOSS]() Topics: [tailscale](), [Homelab](), [Docker](), [Docker Compose](), [traefik]() Tags: [access-controls](), [apps](), [certificates](), [clients](), [compose](), [config](), [configuration](), [containers](), [docker](), [docker-container](), [homelab](), [https](), [ip](), [proxy](), [reverse](), [reverse-proxy](), [services](), [sidecar](), [tailnet](), [tailscale]() ### AI overview Tailscale Services give Docker apps their own HTTPS names on a tailnet while keeping them off the Machines list. A host advertises each Service; `tailscaled` terminates HTTPS and forwards plain HTTP to the app, adding `X-Forwarded-For`. Manual setup requires a tagged host, suitable tag policy and approval, and a `tailscale serve` command per app; published host ports are needed for that route. DockTail automates Service creation and routing from Docker labels, watches container events, and can target container IPs without published ports. It requires Docker socket access, Tailscale state access, and an OAuth client with Services: Write and Devices Core: Write scoped to the host tag. Apps that validate proxy headers may need trusted proxy settings. The author prefers this for changing homelabs because Compose labels track app lifecycle, while noting manual setup is adequate for a few stable containers and a reverse proxy remains preferable for public services on a custom domain. ### Source excerpt Stop bookmarking IP:ports. Tailscale Services gives every Docker container in your homelab its own HTTPS name on your tailnet, without a reverse proxy or a sidecar per container. ## Dual-Node NVIDIA DGX Spark over Tailscale: A Remote-Access Testbed for Distributed LLM Training and Cyber-Threat-Intelligence Fine-Tuning DevFeed: [Dual-Node NVIDIA DGX Spark over Tailscale: A Remote-Access Testbed for Distributed LLM Training and Cyber-Threat-Intelligence Fine-Tuning]() Original publisher: [Read original article]() Author: Vasanth Iyer Published: 2026-11-04T05:00:00Z Content type: article Language: en Sources: [arXiv: Machine Learning]() Topics: [distributed-training](), [DGX Spark](), [Fine-tuning](), [tailscale](), [NCCL](), [Threat Hunting & Intel]() Tags: [cs-ar](), [cs-lg](), [cyber](), [cyber-threat-intelligence](), [dgx](), [dgx-spark](), [distributed](), [fine](), [fine-tuning](), [intelligence](), [llm](), [llm-training](), [node](), [nvidia](), [nvidia-dgx](), [over](), [remote](), [remote-access](), [spark](), [tailscale](), [testbed](), [training]() ### AI overview Two NVIDIA DGX Spark systems completed distributed NanoChat pretraining over a dedicated 200 Gb/s fiber link, with remote administration through Tailscale. Using PyTorch torchrun, DDP, and NCCL, the 896.5-million-parameter run processed about 5.22 billion tokens in 4,980 steps over roughly four days, averaging 63.4 seconds per step. The report documents setup and troubleshooting, including an initial-evaluation bug that caused NCCL timeouts. In fine-tuning experiments, adding data from 77 CISA advisories improved CTI-specific scores but weakened general-knowledge performance, with a small overall score increase. A second stage using a MITRE ATT&CK technique dictionary achieved 98.5% accuracy on dictionary lookups but named none of 50 held-out technique IDs correctly; related held-out threat knowledge remained near zero, and general ability declined. The authors frame the deployment as evidence of feasibility, not scaling efficiency. ### Source excerpt arXiv:2608.07226v2 Announce Type: replace-cross Abstract: Practical evidence for multi-node training on desktop-class accelerators remains limited. This report presents a proof-of-concept deployment of distributed NanoChat pretraining across two NVIDIA DGX Spark systems, each with a GB10 Grace Blackwell system-on-chip and 128 GB of unified memory, administered remotely over a Tailscale mesh VPN and connected for training by a dedicated 200 Gb/s QSFP56 direct fiber link. PyTorch torchrun, DDP, and NCCL were configured with one process per node, a depth-20 NanoChat model, a device batch of 32 sequences per node, a 2,048-token context, and eight gradient-accumulation steps, giving 1,048,576 tokens per optimizer step for the 896.5-million-parameter model. The run took 4,980 steps over about four days, averaging 63.4 s of measured training time per step (about 16,540 tokens/s) and processing about 5.22 billion tokens. We document link configuration, container setup, interface binding, a step-zero evaluation bug that triggered NCCL timeouts, checkpointing, and troubleshooting lessons. We also built a cybersecurity fine-tuning dataset from 77 CISA advisories (338 training, 37 validation conversations) and compared a baseline SFT checkpoint against a CTI-augmented checkpoint on 17 held-out prompts with an Ollama-hosted LLM judge: CTI-specific categories improved while general-knowledge categories regressed, for a small overall change from 2.06 to 2.29 on a 0-10 scale. Version 2 adds a stage-2 fine-tune with a MITRE ATT&CK technique dictionary under a deterministic evaluation: in-dictionary ID-to-name lookup reaches 98.5%, yet none of 50 held-out IDs is named correctly, knowledge of held-out threat groups, software, campaigns, and vulnerabilities stays near zero, and general ability drops measurably. The study establishes feasibility rather than a scaling-efficiency claim. ## Tailscale SSH Security Findings: What Self-Hosters Need to Know DevFeed: [Tailscale SSH Security Findings: What Self-Hosters Need to Know]() Original publisher: [Read original article]() Author: Christian Rakoot Published: 2026-11-02T04:20:54Z Content type: article Language: en Sources: [Self Host Lab]() Topics: [ssh](), [tailscale](), [Access Control](), [Security](), [Homelab](), [Self-hosted]() Tags: [attack](), [authentication](), [credentials](), [device](), [disclosure](), [exploit](), [exploitation](), [fixed](), [funnel](), [homelab](), [initial-access](), [network-security](), [network-security-news](), [news](), [security](), [security-findings](), [self-hosted](), [serve](), [ssh](), [tailnet](), [tailscale](), [tailscale-ssh](), [tailscale-ssh-vulnerability](), [version]() ### AI overview Three confirmed Tailscale SSH security issues, also affecting Serve and Funnel, were fixed in v1.104.4; two other findings were judged intentional. The described risk is privilege escalation in an already authenticated SSH session, including through forwarding, and requires both an attacker foothold on an authorized tailnet peer and an ACL that permits that peer to use Tailscale SSH. The text characterizes this as lateral movement, not unauthenticated initial access. It recommends updating every device to v1.104.4 or later, reviewing SSH ACL permissions, and considering SSH check mode, which requires re-authentication before granting a session. A separate Conn25 issue affects a pre-production feature; the article says stable app connectors currently available are unaffected. ### Source excerpt Tailscale has disclosed a set of security findings affecting Tailscale SSH, plus the related Serve and Funnel features, and has already shipped fixes in version 1.104.4. If you run Tailscale on a homelab or self-hosted tailnet, here's what happened, what it does (and doesn't) mean for your setup, and what to do next. What Tailscale [...] ## From Google Drive to Syncthing over Tailscale DevFeed: [From Google Drive to Syncthing over Tailscale]() Original publisher: [Read original article]() Author: Nicolas Fränkel Published: 2026-11-01T00:00:00Z Content type: article Language: en Sources: [Nicolas Fränkel]() Topics: [tailscale](), [Network Attached Storage (NAS)](), [Virtual Private Network](), [Cryptography]() Tags: [backup](), [database](), [google-drive](), [keepass](), [password](), [password-manager](), [privacy](), [syncthing](), [synology](), [tailscale](), [technical]() ### AI overview The author moved a KeePass `.kdbx` database from Google Drive to Syncthing over Tailscale after KeePassXC's replace-by-rename save behavior sometimes left KeePassium pointing at a deleted Drive file, requiring the hardware security key to be fetched again. Syncthing keeps copies on each device; Tailscale provides stable mesh addresses, allowing discovery, relay, and NAT traversal to be disabled on the NAS and laptop. The setup uses an always-on Synology NAS as a hub with file versioning, a Mac client, and Sync Anything on iOS. The iOS app cannot disable discovery or relaying, and background sync is limited, so the phone may lag and should be opened to sync before use. Offline edits can create conflict copies that KeePassXC can merge. The NAS being down stops syncing, and its version history is not backed up; the author accepts those risks. Other files remain on Google Drive for now. ### Source excerpt I used Dropbox for decades, then switched to Google Drive. Both worked for most of my files. One file never fit, though: my KeePass password database. It's the file I need on every device and the file I want to keep private the most. After one annoyance too many, I moved it to Syncthing over Tailscale. The rest stays on Google Drive, for now. This post describes why and how. The file that made me care My password manager is KeePass-based. ## This is why I want all VPS ports closed and only Tailscale and Cloudflare Tunnel open DevFeed: [This is why I want all VPS ports closed and only Tailscale and Cloudflare Tunnel open]() Original publisher: [Read original article]() Author: Pieter Levels Published: 2026-11-01T00:00:00Z Content type: opinion Language: en Sources: [@levelsio (Pieter Levels)]() Topics: [tailscale](), [Cloudflare]() Tags: [cloudflare](), [cloudflare-tunnel](), [exposed](), [internet](), [linux](), [mptcp](), [port](), [privacy](), [public](), [ssh](), [tailscale](), [tcp](), [tech](), [traffic](), [vps](), [web](), [web-traffic]() ### AI overview The author recommends closing all public VPS ports, using Tailscale for SSH access and Cloudflare Tunnel for web traffic. They argue that exposing even one TCP port can put a Linux server at risk, and mention disabling MPTCP as a stopgap while presenting no public ports as the stronger measure. ### Source excerpt This is why I said you want your VPS ports all closed Then only let it be accessible inside your Tailscale for SSH and via a Cloudflare Tunnel to receive web t... ## This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump DevFeed: [This Week in Security: Broken Embargoes, UEFI Overflow, Wormable Tailscale, Starlink Ad Snooping, and a DHS Directory Dump]() Original publisher: [Read original article]() Author: Mike Kershaw Published: 2026-10-30T14:00:29Z Content type: news Language: en Sources: [Hackaday]() Topics: [Security](), [tailscale](), [Cryptography](), [Memory Safety](), [Critical Infrastructure](), [AI Chat]() Tags: [1-5](), [batch](), [bugs](), [certificates](), [dhs](), [directory](), [dump](), [hackaday-columns](), [hacker-news](), [kernel](), [linux](), [linux-kernel](), [news](), [php2shell](), [public](), [quad9](), [security](), [security-hacks](), [starlink](), [tailscale](), [this](), [this-week-in-security](), [tlp](), [twis](), [uefi](), [us](), [volt-typhoon]() ### AI overview The week's reports show how security failures compound when disclosure, access control, or data retention breaks down. Akamai urges defenders to deploy protections and notify customers privately before publishing exploit details; the article says the `php2shell` aftermath saw exploitation attempts before many administrators knew of a patch. A UEFI PXE buffer overflow can enable pre-boot code execution on network-booting servers; local-disk-only systems are unaffected, and the text recommends checking firmware vendors or disabling unused PXE. Tailscale findings describe root-level SSH forwarding flaws that could let a compromised device spread within its permitted network; suggested mitigations include per-device SSH rules, disabling forwarding, and expiring server node keys. Other reports cover delayed certificate revocation, vulnerable embedded TLS implementations, router-based intrusion chains, ad-bidding location exposure, and breaches of tipster and DHS records. Across these cases, the text highlights practical limits: fixes depend on vendors and operators, and retained or broadly exposed data can create lasting risks. ### Source excerpt Last week brought us at least two broken embargoes: php2shell leaked onto Hacker News a day early, and a batch of Linux kernel bugs landed on the public kernel mailing ...read more ## I wish I had Tailscale when I was at university DevFeed: [I wish I had Tailscale when I was at university]() Original publisher: [Read original article]() Author: Elliot Blackburn Published: 2026-10-30T14:00:00Z Content type: article Language: en Sources: [Tailscale]() Topics: [tailscale](), [dropbox](), [3D]() Tags: [3d](), [aging](), [asset](), [assets](), [aws](), [bots](), [coding](), [compute](), [computer-science](), [database](), [dataset](), [demo](), [desktop](), [digitalocean](), [dns](), [dropbox](), [dynamic-dns](), [files](), [tailscale](), [university]() ### AI overview The author's university workflow relied on Git, Dropbox, and USB drives to move game assets among a desktop, slow laptop, and campus machines. They argue Tailscale could have reduced that file shuffling and enabled remote access: SSH to a home desktop for development or long jobs, MagicDNS for locating it, and Taildrive for browsing shared folders. A Tailscale-connected cloud instance could keep project services' public ports closed while remaining reachable on the tailnet; Funnel is presented as an intentional way to expose a service publicly. For group projects, one-off node sharing grants access to a single machine and can be revoked, while declarative sharing can encode ongoing relationships in tailnet policies with both sides opting in. These uses depend on devices or instances being available, and Tailscale cannot solve teammates' scheduling problems. ### Source excerpt The files I forgot, and the desktop I couldn't reach from campus. ## Tailscale fixes SSH flaws allowing lateral movement within tailnets DevFeed: [Tailscale fixes SSH flaws allowing lateral movement within tailnets]() Original publisher: [Read original article]() Author: Zeljka Zorz Published: 2026-10-28T12:25:04Z Content type: news Language: en Sources: [Help Net Security]() Topics: [tailscale](), [ssh](), [Access Control](), [Security research](), [least privilege]() Tags: [consumer](), [don-t-miss](), [enterprise](), [hot-stuff](), [lateral-movement](), [news](), [remote-management](), [secure-access](), [secure-connectivity](), [smbs](), [ssh](), [tailscale](), [vulnerabilities](), [vulnerability]() ### AI overview Tailscale fixed four vulnerabilities in v1.104.4, including Tailscale SSH flaws that could let an attacker with an already compromised, approved tailnet device gain root access to other machines reachable under the tailnet policy and steal keys to enroll a rogue device. Tailscale disputes the "worm" characterization, describing the spread as lateral movement limited by policy-permitted SSH connections. The report also covered a Conn25 flaw in a pre-production feature, which Tailscale says will be fixed before release, and denial-of-service issues affecting self-hosted control servers or device enrollment. Users should upgrade to v1.104.4, review SSH policies, and consider Check mode for sensitive systems. ### Source excerpt Tailscale, the company behind the popular software-defined mesh networking and connectivity platform of the same name, has shipped fixes for several vulnerabilities, including some in Tailscale SSH that could let an attacker who already had access to a device in the network gain more privileges on other machines that are part of it. "Based on our investigation, an attacker could reach only machines the tailnet policy file already permitted SSH connections to," said Mike Shaver, ... More -> The post Tailscale fixes SSH flaws allowing lateral movement within tailnets appeared first on Help Net Security. ## Tailscale SSH: Findings and fixes DevFeed: [Tailscale SSH: Findings and fixes]() Original publisher: [Read original article]() Author: Mike Shaver Published: 2026-10-28T01:15:00Z Content type: news Language: en Sources: [Tailscale]() Topics: [tailscale](), [ssh](), [Access Control](), [bugfixes]() Tags: [ssh](), [tailscale](), [tailscale-ssh](), [version]() ### AI overview Tailscale v1.104.4 fixes SSH vulnerabilities involving privilege enforcement after authorization: under certain conditions, an attacker with a foothold on an authorized tailnet device could use an allowed SSH session, including forwarding, beyond the configured local user's privileges. Exploitation required SSH access permitted by tailnet policy; the flaws did not let unauthenticated attackers connect to arbitrary servers. The report's "Tailworm" label does not describe self-replicating malware. The release also fixes three Serve and Funnel bugs; two other reported behaviors require local admin access or an opt-in setting and work as designed. Conn25 remains unreleased and affected, while stable app connectors are not. Tailscale recommends updating to v1.104.4 or later, reviewing SSH policies, and considering SSH check mode for sensitive systems. ### Source excerpt What Tailscale version 1.104.4 fixes in Tailscale SSH. ## Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws DevFeed: [Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws]() Original publisher: [Read original article]() Author: Eduard Kovacs Published: 2026-10-27T15:26:12Z Content type: news Language: en Sources: [SecurityWeek]() Topics: [tailscale](), [Security research](), [ssh](), [patches](), [Virtual Private Network]() Tags: [attack](), [automated](), [cloud-metadata](), [controversy](), [denial-of-service](), [device-identity](), [disclosure](), [dos](), [exploit](), [featured](), [in-the-wild-exploitation](), [keys](), [patches](), [ssh](), [tailscale](), [tailscale-ssh](), [tailworm](), [vulnerabilities](), [vulnerability]() ### AI overview The Tailworm report describes privilege-escalation flaws in Tailscale SSH that could let an attacker who has already compromised an authorized device gain root access to reachable servers when SSH forwarding is allowed. Researchers demonstrated automated, wormable movement between policy-authorized servers without user interaction. The report also identifies issues in the experimental app connector, Serve, headscale, and the relay component, including potential access-rule bypasses and denial of service. Tailscale said most fixes were in place and planned a patched client release pending testing; at the time described, fixes had not yet reached a numbered release. Until then, it advised reviewing SSH policies and disabling forwarding where unnecessary, while saying it did not recommend disabling Tailscale SSH across the board. The excerpt reports no confirmed in-the-wild exploitation. ### Source excerpt Tailscale is preparing a patch for Tailscale SSH flaws whose details went public over the weekend, before any fixes had been released. The post Tailscale Rushes Patches After Uncoordinated Disclosure of 'Tailworm' Flaws appeared first on SecurityWeek. ## Tailscale warns of SSH flaws allowing root privilege escalation DevFeed: [Tailscale warns of SSH flaws allowing root privilege escalation]() Original publisher: [Read original article]() Author: Sergiu Gatlan Published: 2026-10-27T14:09:46Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [tailscale](), [Vulnerabilities](), [ssh](), [cve remediation](), [Security](), [Access Control](), [Security research](), [software security audit](), [least privilege]() Tags: [code-execution](), [computer-help](), [computer-security](), [computers](), [crash](), [credential-theft](), [credentials](), [denial-of-service](), [elevation-of-privileges](), [exploited](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [patch](), [privilege-escalation](), [root](), [security](), [security-vulnerabilities](), [servers](), [spyware](), [ssh](), [support](), [tailscale](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [vpn](), [vulnerabilities](), [windows]() ### AI overview Cyberdione Labs reported 11 unpatched Tailworm vulnerabilities in audited releases of Tailscale and the self-hosted headscale control server. The most critical described flaw is in Tailscale SSH: an attacker already authorized to connect may, under some conditions, gain elevated privileges through Unix-socket forwarding. Tailscale said exploitability depends on access permissions, system configuration, and other conditions, and was still assessing the affected configurations. It did not recommend disabling Tailscale SSH for everyone. Interim steps were to restrict SSH access to needed users and devices, disable forwarding by setting TS_SSH_DISABLE_FORWARDING=1 in the tailscaled service environment and restarting it, and tighten access to sensitive systems. Tailscale urged users to prepare to install a patched client release; the excerpt gives the team's target timing but does not confirm a release. ### Source excerpt The Tailscale security team is working to patch almost a dozen security vulnerabilities that could be exploited to steal credentials, crash servers, gain root privileges, and more. [...] ## Where Tailscale VPN ends and Tailscale PAM begins DevFeed: [Where Tailscale VPN ends and Tailscale PAM begins]() Original publisher: [Read original article]() Author: Andrew Cunningham Published: 2026-10-26T14:00:00Z Content type: article Language: en Sources: [Tailscale]() Topics: [tailscale](), [Access Control](), [Virtual Private Network](), [ssh]() Tags: [access-controls](), [amazon-s3](), [clusters](), [logs](), [pam](), [tailscale](), [vpn]() ### AI overview Tailscale VPN creates a peer-to-peer tailnet for connections among users, devices, and apps; Tailscale PAM adds controlled, auditable access to infrastructure services. PAM requires at least one connector on each network being reached. Connectors mediate access over WireGuard-encrypted tunnels and let administrators apply service-specific, real-time permissions, inject credentials, and grant temporary access. Users with the Tailscale client can launch locally installed apps; client software is optional when services are configured for browser access, though users must still sign in. PAM logs user and device details, connection time, and duration; optional recordings include database query logs and SSH text and video, with HTTP, Kubernetes, and S3 recording also available. Recordings are generally stored by Tailscale; Amazon S3 storage is available on the Premium plan. Both products use the same identity layer and admin console and are described as complementary. ### Source excerpt Tailscale VPN locks the door. PAM logs who makes it through. ## I spent all day having Claude Code security audit every VPS I have DevFeed: [I spent all day having Claude Code security audit every VPS I have]() Original publisher: [Read original article]() Author: Pieter Levels Published: 2026-10-25T00:00:00Z Content type: opinion Language: en Sources: [@levelsio (Pieter Levels)]() Topics: [software security audit](), [Security](), [Network Segmentation](), [audit](), [Claude Code](), [DevSecOps]() Tags: [ai](), [ai-models](), [attack](), [audit](), [claude-code](), [claude-code-security](), [defense](), [entrepreneurship](), [permission](), [policies](), [saas](), [security](), [security-policies](), [security-updates](), [server](), [services](), [site](), [tailscale](), [tech](), [ubuntu](), [vps](), [website]() ### AI overview The author describes asking Claude Code to audit each VPS and website, alongside unattended Ubuntu security upgrades with periodic automatic reboots, Tailscale policies intended to isolate servers from one another and personal devices, and restricted service permissions such as running web services as www-data. They propose adding a recurring "security week" and repeating AI-assisted audits, while expressing uncertainty about whether AI offense and defense capabilities will remain matched. ### Source excerpt Yesterday I spent all day typing this into Claude Code: "Do a full security audit of this website and server" On every single VPS (and site) I have I already h... ## I recommend taking your VPS off the public internet with Tailscale and Cloudflare Tunnel DevFeed: [I recommend taking your VPS off the public internet with Tailscale and Cloudflare Tunnel]() Original publisher: [Read original article]() Author: Pieter Levels Published: 2026-10-23T00:00:00Z Content type: opinion Language: en Sources: [@levelsio (Pieter Levels)]() Topics: [tailscale](), [Cloudflare](), [Virtual Private Network](), [Internet]() Tags: [ai](), [app](), [attack](), [cloudflare](), [cloudflare-tunnel](), [exploit](), [exploits](), [firewall](), [hetzner](), [internet](), [network](), [open](), [privacy](), [private](), [public](), [security](), [server](), [site](), [ssh](), [tailscale](), [tech](), [tutorial](), [vps]() ### AI overview The author recommends reducing direct public access to a VPS by combining Cloudflare Tunnel for a website or app with Tailscale for server access. In this setup, Cloudflare Tunnel carries web traffic so the VPS no longer responds directly on ports 80 or 443; Tailscale provides a private network for the author's devices and VPS. The author says both services connect outward, then advises blocking regular VPS access through the firewall and testing that block. They frame this as reducing the attack surface against application exploits and exposed server ports, while acknowledging it is not perfect. The excerpt presents the author's recommendation, not evidence that the setup prevents attacks. ### Source excerpt Maybe important to repost this now that everyone is getting hacked If you have a VPS, I recommend you to get if off the public internet and into a Tailscale ne... ## GL.iNet Comet Q GL-RMQ1 Review A Single USB Type-C Cable Remote KVM Device with Tailscale DevFeed: [GL.iNet Comet Q GL-RMQ1 Review A Single USB Type-C Cable Remote KVM Device with Tailscale]() Original publisher: [Read original article]() Author: Eric Smith Published: 2026-10-18T22:16:42Z Content type: comparison Language: en Sources: [ServeTheHome]() Topics: [Jetkvm](), [tailscale](), [USB](), [hdmi]() Tags: [connectivity](), [gl-inet](), [hardware](), [hdmi](), [ikvm](), [ip](), [keyboard](), [kvm](), [mobile](), [network](), [tailscale](), [usb]() ### AI overview The GL.iNet Comet Q GL-RMQ1 is a remote KVM that connects to compatible devices through one USB-C cable, which carries video, keyboard and mouse input, remote media, and power. It uses Wi-Fi for network connectivity and can also connect to phones and tablets. The review describes its touchscreen, setup, and browser-based management, and notes that some systems may boot too quickly to enter the BIOS through the device. ### Source excerpt In our GL.iNet Comet Q (GL-RMQ1) review, we see how this USB Type-C remote KVM device with Tailscale makes connectivity easy The post GL.iNet Comet Q GL-RMQ1 Review A Single USB Type-C Cable Remote KVM Device with Tailscale appeared first on ServeTheHome. ## web-edit 0.1a2 DevFeed: [web-edit 0.1a2]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-17T13:16:49Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [Web app](), [Web]() Tags: [data](), [deepseek](), [deepseek-36](), [pelican-riding-a-bicycle](), [pelican-riding-a-bicycle-151](), [projects](), [projects-559](), [release](), [tailscale](), [web-app]() ### AI overview web-edit 0.1a2 is a small web app for browsing and editing files in a folder, including files on different machines via Tailscale. This release adds an option to copy text and image data to the clipboard, useful for moving logs from a phone-based workflow into a Gist. ### Source excerpt Release: web-edit 0.1a2 web-edit (previously) is my tiny web app for browsing and editing files in a folder. I mainly built it for editing files on different machines via Tailscale. I added a "copy to clipboard" option for both text and image data. I needed this because I was running pelican prompts on a laptop from my phone (here's DeepSeek 4.1 Flash 1017) and I wanted an easy way to copy the resulting logs into a Gist. Tags: projects, pelican-riding-a-bicycle, deepseek ## Self-host a local AI stack and access it from anywhere DevFeed: [Self-host a local AI stack and access it from anywhere]() Original publisher: [Read original article]() Author: ameliepangolin Published: 2026-10-14T08:00:06Z Content type: tutorial Language: en Sources: [HackerNoon]() Topics: [Self Hosted AI Tools](), [Ollama](), [open webui](), [NixOS](), [Local AI](), [tailscale](), [internal developer platform automation](), [Security](), [CI/CD]() Tags: [ai](), [automation](), [deployment](), [docker](), [good-company](), [local-ai](), [local-ai-lab-setup](), [nixos](), [nixos-ai-configuration](), [offline-ai-server](), [ollama](), [ollama-and-open-webui](), [open-webui](), [private-ai](), [proxmox](), [proxmox-gpu-passthrough](), [self-host](), [self-hosted-llms](), [tailscale](), [tailscale-remote-ai-access]() ### AI overview This video tutorial walks through building a private, self-hosted local AI lab using Proxmox, NixOS, Docker, an NVIDIA GPU, Ollama, and Open WebUI. It covers secure remote access through Tailscale and deployment automation with Ansible. ### Source excerpt Build a private AI lab with Proxmox, NixOS, an NVIDIA GPU, Ollama, and Open WebUI, with automated deployment and secure remote access through Tailscale. ## web-edit 0.1a0 DevFeed: [web-edit 0.1a0]() Original publisher: [Read original article]() Author: Simon Willison Published: 2026-10-12T15:54:36Z Content type: release Language: en Sources: [Simon Willison's Weblog]() Topics: [AI Chat](), [Web]() Tags: [30-million-nasa-mission](), [ai](), [ai-2-275](), [codex](), [codex-60](), [generative-ai](), [generative-ai-2-017](), [gpt-6](), [gpt-6-astra](), [llms](), [llms-1-983](), [projects](), [projects-557](), [python](), [python-1-290](), [tailscale](), [tailscale-13]() ### AI overview A Python web app lets users browse and edit files in a folder through a mobile-friendly web interface. It is intended to run over Tailscale, allowing files such as credentials to be edited from a phone without sending them through an LLM; the interface uses CodeMirror 6. ### Source excerpt Release: web-edit 0.1a0 I was working on a project from my phone using Codex Remote when I found myself wanting to edit a credentials file without round-tripping those credentials through the LLM itself. So... I had Codex and GPT-6 Astra Extra High build this Python web app which provides a web UI for viewing and editing files in a folder. It's intended to be run over Tailscale, so I can have an agent start this running and then edit files via my Tailscale network directly from my phone. Here's the interface for browsing files in a folder: Editing uses CodeMirror 6 - I was going to use Monaco but that still doesn't have a great mobile experience yet. Tags: projects, python, ai, tailscale, generative-ai, llms, codex ## Fixing my ridiculous fridge with a tiny Funnel site DevFeed: [Fixing my ridiculous fridge with a tiny Funnel site]() Original publisher: [Read original article]() Author: ameliepangolin Published: 2026-10-12T10:29:23Z Content type: article Language: en Sources: [HackerNoon]() Topics: [tailscale](), [hosting](), [Web](), [Homelab]() Tags: [agentic-ai-framework](), [apis](), [browser](), [certificates](), [claude-code](), [container](), [custom-web-dashboard](), [devices](), [dns](), [docker](), [docker-container](), [docker-node-js-web-app](), [good-company](), [private-access](), [samsung](), [self-hosted-web-applications](), [smart-fridge](), [tailscale](), [tailscale-funnel](), [tailscale-public-url](), [tailscale-secure-remote-access](), [tailscale-serve](), [tailscale-serve-vs-funnel]() ### AI overview The author describes adapting a lightweight transit and bike-share dashboard for a Samsung smart fridge, then hosting it from a NAS in a Docker container. Tailscale Funnel makes the small, mostly public app accessible outside the home, while the article explains why private services such as Home Assistant or an AI agent with access to personal data should use Tailscale Serve instead. ### Source excerpt Discover how Tailscale Funnel powers a lightweight custom web dashboard on a Samsung smart fridge and when to choose private access with Tailscale Serve. [Next page]()