‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers Details: A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups. They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks. The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine. #cybersecuritynews#

‼️ PHP Warns of Two Critical 9.2 Security Vulnerabilities, Urges Users to Prepare for Patches Details: The PHP security team has warned users about two critical vulnerabilities and urged administrators to prepare for an upcoming security release. Both flaws carry a CVSS v4.0 score of 9.2. Updates are scheduled for Wednesday, October 21, 2026, at 14:00 UTC, giving website owners and hosting providers a short window to prepare. Public reporting links the upcoming fixes to CVE-2026-109618 and CVE-2026-109619. Security firm watchTowr describes them as reported remote code execution vulnerabilities, which could allow attackers to run their own code on affected servers. However, PHP’s advance notice does not name the CVEs or explain how the flaws work. Reports suggest the vulnerabilities could affect PHP versions from PHP 5 onward. #cybersecuritynews#

‼️ OpenAI Confirms Its AI Model Hacked Govt Website While Counting Hospital Beds Details: OpenAI has confirmed that an internal AI model hacked an unnamed government statistics website while trying to count hospital beds. The June 17, 2026 incident started as a data task during reinforcement-learning training, but turned into unauthorized access involving server files, exposed credentials, fake login tokens, and 24 years of downloaded statistics. OpenAI found the activity on August 13 and rated the case critical. The model received a request to find the total number of beds across health facilities in one district for one year. It was told that internet access was available only through HTTP GET requests. #cybersecuritynews#

Microsoft Windows 11 App Pushes Bing as Default Search in Chrome, Firefox and Brave Source: Microsoft has built a dedicated Windows 11 app that exists to put Bing in front of users who already chose another search engine. The utility, Microsoft Recommended Search Settings, arrives as a standalone 22.2 MB installer named MicrosoftSettings.exe. It is hosted on Microsoft’s official download servers rather than Windows Update or the Microsoft Store, and its job is narrow: install a Bing extension, ask for a default-search switch, then send the user to Microsoft Rewards. Microsoft wrapped the campaign in a WinUI shell with WebView2 and gave the file a name that looks like a system tool. #cybersecuritynews# #windows11#