Tailscale patches four SSH and Serve flaws that allowed root-level access via v1.104.4

·6 views

Tailscale has released version 1.104.4 along with four security bulletins, TS-2026-014 through TS-2026-017, addressing vulnerabilities in Tailscale SSH and Tailscale Serve. The flaws were first described in a report published by a security researcher the previous weekend, after concerns surfaced publicly on October 23. The most serious issue let authenticated users exploit Unix socket forwarding, because the daemon, which runs as root, validated paths lexically and acted with root privileges. Related weaknesses in Serve could enable full node takeover, and a separate bug allowed unbounded memory growth in tailscaled. The fix shifts Unix socket forwarding to run under the authenticated user's permissions and revalidates backend targets on every connection.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ToolNest Offers 12 Free Browser-Based Calculators, Including EMI and GST

A developer has compiled twelve everyday calculators, such as EMI, GST, BMI, and age, on a single site called ToolNest. The tools run entirely in the browser using JavaScript, so no user data is uploaded, stored, or logged. No sign-up, installation, or paid tier is required to use them. The EMI calculator, for example, shows the monthly instalment, total amount paid, and total interest for a loan, illustrating that a ₹5,00,000 loan at 9% over five years costs about ₹1,22,751 in interest.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Industry Faces Scrutiny Over Costs, Sustainability and Model Proliferation

An opinion piece argues that a growing catalogue of AI models does not by itself guarantee a sustainable industry. The author questions whether rapid expansion is genuinely solving more problems or mainly multiplying options to compare. Cited concerns include massive projected cash burn at major AI firms, energy demand from data centres, and market volatility following AI announcements. The piece stresses that reliability, affordability and practical results matter more than sheer model choice. It was published on DEV Community on 28 October 2026 and draws on a range of financial and industry sources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Designing Kafka Consumers on EKS for Frequent Pod Restarts and Rebalances

Kafka consumers are stateful clients whose group membership must remain stable, but Kubernetes routinely restarts, throttles, and reschedules pods, which the group protocol treats as membership changes. The author argues most consumer incidents on EKS stem from this clash rather than from Kafka defects. A baseline configuration with a generous session timeout, a poll interval with headroom, manual offset commits, and cooperative-sticky assignment prevents many problems outright. The post then examines eight recurring failure modes, each explained by its symptom, underlying mechanism, and usually a simple config change or lifecycle hook. The overarching guidance is to treat restarts as a permanent condition to design around, using stable identities and a graceful shutdown path.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tests find LaTeX resume templates differ sharply in ATS parsing, with one losing the candidate's name

A resume parser developer tested three popular LaTeX resume templates and scored how reliably each could be read by automated systems. Jake's Resume parsed cleanly with 98 of 98 checks passed, while Awesome-CV scored 53 and moderncv scored 39. The main differences came down to whether templates embed a glyph-to-character map and avoid layout choices like multi-column designs or icon-based contact details. Awesome-CV's example PDF encodes hyphens and dashes in dates as invisible soft hyphens, which broke a cloud-native keyword match and split date ranges, and moderncv's address block led the parser to treat a street address as the candidate's name. The author recommends including specific pdfLaTeX lines, placing the name first, writing contact details as plain text, and checking the final PDF's extracted text.

0 comments Read more at DEV Community