AI translation. Check versions, conditions and actions against the Japanese original and primary sources.
DAILY RECORD · 2026-10-25
10/25Tailworm special coverage and a broad overnight supplement.
Read research prerequisites, evidence of actual exploitation, and recovery targets separately.
Review as of 10/26 10:27 JST. Exact JST dates remain unconfirmed for items whose original sources provide only dates.
Research report and investigation special coverage · 23:18 JST coverage cutoff (not attack start date)
Review Tailworm by feature and permissions
Organized Tailscale/headscale SSH, connection permissions, conn25, Serve, and other features. Do not turn the number of researcher-listed items into actual incident counts.
What to check Reduce unnecessary permissions and exposed features. Do not call Tailscale 1.104.2 or headscale 0.29.6 Tailworm fixes without evidence.
ConnectWise: resumption targets and formal instructions
The plan is to provide restoration access to existing backups first, followed by re-registration guidance. 10/26 is a phased-resumption target, not completed resumption or permission for every customer to reconnect.
What to check Keep connections disabled until the formal procedure applicable to you, and investigate permissions, credentials, and email operations in customer M365 environments.
NVD inclusion / this investigation updated · Cutoff 23:18 JST
Supplementing existing advisories for authentication, administration, and AI execution infrastructure
Snipe-IT, Parse Server, rclone, vLLM, Firecrawl, Dokploy, Paisa, rotki, and others. Dates of inclusion in NVD or GHSA differ from developer disclosure dates and attack start dates.
What to check Preserve discrepancies in affected conditions and minimum fixed versions. Do not say 0.24.0 fixes every vLLM issue; verify unresolved rclone and Dokploy details against primary sources.