On October 25, 2026, researcher Erica Windisch published Tailworm, a report showing that Tailscale SSH combined with port forwarding grants root access to every reachable server once a single device on the mesh is compromised. With no patch and no CVE so far, the immediate fix comes down to three settings: pairwise access rules, port forwarding off, and Tailnet Lock.

Headplane, spotlighted by selfh.st on October 9, 2026, adds to Headscale — the open-source reimplementation of Tailscale’s control server — a web interface with OIDC single sign-on, remote SSH, and tailnet settings management. It is the missing piece for self-hosting your own mesh network without giving up usability.

WireGuard has been in the Linux kernel since March 2020, Tailscale crossed $100M ARR in early 2026, and Headscale has passed 42,000 GitHub stars. If you self-host more than two services, a free or self-controlled mesh VPN transforms remote access without a single firewall rule.