Esto siiii es algo para preocuparse 🤯 Quien no tienes sus agentes conectados via SSH con Tailscale 👀?
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailscale-ssh-…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
1
0
2
47
Hermes Bot beta is officially live 🤖🔥 Time to see if an open-weights model can out-wit and out-context the proprietary competition (looking at you, GrokBot).
Huge W for the open-source community. Are you guys testing out the beta yet? Drop your first impressions below.
@NousResearch @Teknium
Hermes Agebt Bot era is comming
🔥👇
Huge W for the open-source community. Are you guys testing out the beta yet? Drop your first impressions below.
@NousResearch @Teknium
Hermes Agebt Bot era is comming
🔥👇
1
0
2
54
Para los 20 que se guardaron este post: así es como funciona realmente el sistema de créditos en @MiniMax_AI Mínimax Code 🛠️👇
Tienen un ciclo de Daily Check-in de 7 días.
Empiezas recibiendo 400 créditos diarios, pero al cumplir el día 4 y el día 7 de racha te regalan 1,000 da uno. (4,000 créditos por ciclo).
Literalmente te financian el desarrollo pesado con 1M de contexto en M3.1-Flash solo por ser constante. Una joya para indie hackers 💎🔥
Tienen un ciclo de Daily Check-in de 7 días.
Empiezas recibiendo 400 créditos diarios, pero al cumplir el día 4 y el día 7 de racha te regalan 1,000 da uno. (4,000 créditos por ciclo).
Literalmente te financian el desarrollo pesado con 1M de contexto en M3.1-Flash solo por ser constante. Una joya para indie hackers 💎🔥
@victorundr @MiniMax_AI MiniMax M3.1-Flash te registras en su sitio web . Instalas MiniMax Code y todos los días te dan 400 Créditos para sacarle el jugo. Con 1M de contexto y el Harness me parece que va de lujo 🔥
0
0
6
376
Cómo auditar y blindar tu servidor en minutos sin leer cientos de boletines CVE 🤖🔒
Si ya vinculaste tu proyecto de Codex por SSH a tu máquina, dale este prompt a GPT-6 Astra (puedes intentarlo con Claude Code / Opus 5.5, si es que su molesto clasificador automático no entra en pánico y te bloquea 😂):
📋 El Prompt:
"Conéctate en línea e investiga todas las cosas que han sucedido en seguridad de la información en los últimos 5 días. Hoy es 24 de octubre de 2026. Luego corrige cualquier problema de seguridad en todas partes del servidor. Hazme preguntas si lo necesitas."
¿Qué modelo les está dando menos falsos positivos al tocar infraestructura por SSH últimamente? 👀👇
Si ya vinculaste tu proyecto de Codex por SSH a tu máquina, dale este prompt a GPT-6 Astra (puedes intentarlo con Claude Code / Opus 5.5, si es que su molesto clasificador automático no entra en pánico y te bloquea 😂):
📋 El Prompt:
"Conéctate en línea e investiga todas las cosas que han sucedido en seguridad de la información en los últimos 5 días. Hoy es 24 de octubre de 2026. Luego corrige cualquier problema de seguridad en todas partes del servidor. Hazme preguntas si lo necesitas."
¿Qué modelo les está dando menos falsos positivos al tocar infraestructura por SSH últimamente? 👀👇
0
0
0
94
Seguimos con los Hackers Games en la web
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email support@keyst.one. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
0
0
1
99
Cómo les va hoy?
La propuesta sigue en pie ... Estamos conectando con ellos 🤜🤛
La propuesta sigue en pie ... Estamos conectando con ellos 🤜🤛
Hey @X algorithm 👋 i need your help buddy.
Stop showing me engagement bait and connect me with people who:
Have 14 unfinished side projects & 30 unused domains 🌐
Are actively building with AI & LLM APIs 🤖
Ship SaaS products instead of just talking about them 🚀
Live the indie halife 🛠️
Push straight to main when nobody is looking 💻
If this is you, drop what you’re building below so I can check it out! Let's connect 🤝👇
0
0
3
140
HashVibe | AI & Web3 🛡️ retweeted
Watching the actual unquantized DeepSeek Flash 1017 effortlessly clean up the wreckage left behind by DeepSeek Flash (Temu Edition) is sooo satisfying.
Just canceled OpenCode Go. I’m done with AI subscriptions.
The sneaky quantization rugpull is obnoxious.
If I’m going to run a degraded model, I’ll run a quantized version on my own hardware for free.
36
9
789
47,226
Hey @X algorithm 👋 i need your help buddy.
Stop showing me engagement bait and connect me with people who:
Have 14 unfinished side projects & 30 unused domains 🌐
Are actively building with AI & LLM APIs 🤖
Ship SaaS products instead of just talking about them 🚀
Live the indie halife 🛠️
Push straight to main when nobody is looking 💻
If this is you, drop what you’re building below so I can check it out! Let's connect 🤝👇
Stop showing me engagement bait and connect me with people who:
Have 14 unfinished side projects & 30 unused domains 🌐
Are actively building with AI & LLM APIs 🤖
Ship SaaS products instead of just talking about them 🚀
Live the indie halife 🛠️
Push straight to main when nobody is looking 💻
If this is you, drop what you’re building below so I can check it out! Let's connect 🤝👇
12
0
18
772
Quedan 999...@ZenMuxAI 🤣
🎁 FREE TOKEN DROP
1,000 packs × 500,000 Kimi K3.1 Pro tokens each.
Kimi K3.1 Pro or Opus 5.5?
Try it yourself on ZenMux 👇
zenmux.ai/gift/AQAAAABq5…
1
0
0
105
HashVibe | AI & Web3 🛡️ retweeted
If you put a VPS on Tailscale, fix these two things immediately:
Disable key expiry (Machines → ··· → Disable Key Expiry). Otherwise, you risk losing access after 180 days.
Lock down your ACLs. Tag the VPS tag:server and only allow inbound connections from your own devices. Don't allow the server to initiate connections to your other machines.
By default, Tailscale allows everything to talk to everything, and device keys expire.
A compromised VPS shouldn't give an attacker access to your entire tailnet.
Disable key expiry (Machines → ··· → Disable Key Expiry). Otherwise, you risk losing access after 180 days.
Lock down your ACLs. Tag the VPS tag:server and only allow inbound connections from your own devices. Don't allow the server to initiate connections to your other machines.
By default, Tailscale allows everything to talk to everything, and device keys expire.
A compromised VPS shouldn't give an attacker access to your entire tailnet.
25
44
1,325
96,487