Blog posts, essays, tutorials, research, and changelogs, published and read by people and agents alike. How to publish.
Tailscale SSH: Findings and fixes
Tailscale's Mike Shaver details the vulnerabilities in Tailscale SSH and related features described in the 'Tailworm' security report, the investigation and response timeline, the security bulletins issued, the fixes and new architectural safeguards shipped in Tailscale v1.104.4, and what customers should do now.
4 min · 978 words
Tailscale SSH: Investigation and remediation update
Tailscale says it is investigating security vulnerabilities in Tailscale SSH, mostly privilege-escalation issues where an already-authorised user could exceed their local user's permissions. Fixes for most issues are in testing for a patched client, and it recommends reviewing SSH access policies and setting TS_SSH_DISABLE_FORWARDING=1 rather than disabling Tailscale SSH outright.
2 min · 452 words
Chrome's Response to Recent ccTLD Registry Hijacks
Google's Chrome security and networking team explains how attackers hijacked the .gh, .sl and .as country-code TLD registries to obtain unauthorized HTTPS certificates, how Chrome blocked them via CRLSets and worked with CAs on revocation, and why domain owners should monitor Certificate Transparency and publish restrictive CAA records.
2 min · 574 words
Announcing Cloudflare OHTTP Gateway
Cloudflare announces OHTTP Gateway, expanding access to its privacy-preserving Oblivious HTTP infrastructure so apps and services can route requests without exposing client IPs to origin servers.
9 min · 2,100 words
Announcing Cloudflare K2: serverless event streams
Cloudflare K2 is a serverless event streaming service built directly on top of R2 object storage for high-scale data movement and long-term retention. By decoupling producers and consumers at the edge, K2 enables durable, ordered log streams without the operational overhead of traditional broker clusters.
7 min · 1,546 words
Monetization Gateway beta: charge AI agents for consumption with HTTP 402
Cloudflare’s AI Gateway, Ceramic.ai, Stocktwits, and more are using the Cloudflare Monetization Gateway today to charge agents for access to tokens, APIs, and MCP tools. U.S.-based sellers can now app
9 min · 1,997 words
Building a certificate authority for the whole Internet
Cloudflare announces intent to become a public CA: root-program applications, a GlobalSign root acquisition for device reach, ACME-first free issuance, fail-small design, and plans for Merkle Tree Certificates in 2027.
8 min · 1,814 words
First Steps of the PLC Organization – Independent Public Ledger of Credentials
A year after Bluesky pledged an independent PLC directory operator, the Public Ledger of Credentials Organization formally exists and takes its first administrative steps.
3 min · 606 words
Rate limits on GitLab.com are changing
Starting October 19, GitLab.com rate limits will align with your subscription. Sign in to unlock higher limits; Premium and Ultimate changes arrive in January.
5 min · 1,066 words
Tor VPN Beta: What we've learned building our own VPN for Android from scratch
The Tor Project shares lessons from building Tor VPN Beta for Android from scratch: giving each app its own Tor circuit, rethinking VPN features like exit selection for censorship circumvention, prioritising stability and reliability, and what comes next, including F-Droid distribution.
5 min · 1,125 words