On October 25, 2026, researcher Erica Windisch published Tailworm, a report showing that Tailscale SSH combined with port forwarding grants root access to every reachable server once a single device on the mesh is compromised. With no patch and no CVE so far, the immediate fix comes down to three settings: pairwise access rules, port forwarding off, and Tailnet Lock.
OpenSSH 10.6, released on October 6, 2026, disables the LZ77 coder in SSH compression and rejects dollar and backslash characters in command-line usernames. If your automated transfers rely on SSH compression or your scripts build usernames from external input, check both before you upgrade.
CERT Polska has documented the MikroTrick chain: two RouterOS SSH flaws, CVE-2026-67279 and CVE-2026-86060, combine to hand attackers full administrative control of an exposed router with no password and no SSH key. CISA added CVE-2026-67279 to its KEV catalog on September 25, 2026: patch to 6.49.21, 7.23.4 or 7.24.2 and hunt for signs of compromise.
CERT Polska warns that attackers are taking full administrative control of MikroTik routers whose SSH service is reachable from the internet, without authentication. Update RouterOS and audit the configuration before putting any device back into service.
OpenSSH 10.4 shipped in July 2026, multiplexing saves 5 seconds per connection, and SSH certificates have been replacing authorized_keys since 2010 without anyone noticing. If you're still typing passwords to reach your servers, this article is for you.
