Daily Brief
Tailscale SSH root risk and PHP2Shell abuse
Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers
A researcher found that a hacked device on a Tailscale network can be used to gain root access on other reachable servers when Tailscale SSH is set to allow port forwarding. It matters because the weakness turns one compromised endpoint into privileged access on adjacent systems.
Review Tailscale SSH settings this week and disable port forwarding where it is not required.
PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking
Attackers are exploiting PHP2Shell vulnerabilities and using agentic AI platforms for post-exploitation activity. In one case, a European government entity was targeted and password hashes and multi-factor data were accessed within two hours, showing fast follow-on abuse after initial entry.
Prioritise patching PHP2Shell-related systems and check for signs of rapid post-exploitation on exposed hosts.