# Tailscale's Tailworm fixes, Mac git and the eMudhra certificates, Discord's web search change and the authors' suits against Anthropic: four developer stories in one Daily Diff

Published: 2026-10-28

Four developer stories from one Wednesday, each attributed to its primary source: Tailscale released version 1.104.4 after a researcher's report named Tailworm described SSH forwarding that reached root-only sockets; a researcher site says git, curl and python on macOS still accept certificates from the compromised eMudhra intermediates, while Apple's support page explains why command line tools read a separate certificate file; Discord says Discoverable Server discussions will move into web search from mid-December, with controls available now; and the Stanford Daily reports that professors who opted out of the Bartz settlement are suing Anthropic separately. The suits are allegations, the Apple fix has no published date, and the verdict is NEEDS REVIEW.

Canonical: https://thedailydiff.dev/video/2026-10-28-tailworm-emudhra-discord/

## What this video covers

- Tailscale (blog post, October 28, 2026) says it received the Tailworm report, published by researcher Erica Windisch of Cyberdione Labs, on the morning of Saturday, October 24, and that the researcher published it two hours later. The tested versions were Tailscale 1.104.2 and headscale 0.29.5. Tailscale's fixes are in version 1.104.4, with four security bulletins numbered TS-2026-014 through TS-2026-017.
- Tailscale's bulletin on SSH Unix socket forwarding says the SSH server in the root-privileged tailscaled process validated socket paths lexically but performed the operations as root, which allowed privileged dials through local forwarding, deletion of root-owned sockets through remote forwarding, and a race where the kernel re-resolves the path after the check. Reachable targets included the Docker socket and the tailscaled local API. Tailscale now forwards sockets as the authenticated user. Until updated, setting the documented TS\_SSH\_DISABLE\_FORWARDING environment variable to 1 disables forwarding without disabling Tailscale SSH.
- Tailscale says exploitation needs an existing foothold on an authorized device in the tailnet, with SSH access and forwarding permitted by policy, and that the path is lateral movement limited to connections the policy allows, and does not describe a self-replicating worm. The researcher's page says the flaws were found with low effort.
- A researcher site run by Dennis Jackson with community contributors says Apple was notified of the eMudhra intermediate certificate incident on October 17 and that, as of October 28, git, curl and python3 shipped with macOS still accept the compromised certificates; it also says macOS 27.2, released October 26, did not fix the issue and undid manual workarounds. Apple's support page confirms the split: since October 19 Safari, Mail and apps on Apple's frameworks block the certificates, while tools such as curl, git, python3, ruby, perl and openssl that check /etc/ssl/cert.pem can still accept them until a future update. Apple's page gives optional manual steps and warns an update can replace the file.
- Discord's blog post (October 27, 2026) says all Discoverable Servers, which need at least 1,000 members and number more than 63,000, will have a public Server Web Page from November 16, 2026, with automated Channel Summaries able to start the same day. From mid-December 2026, messages from admin-allowed public channels can appear on Server Web Pages and in web search without usernames or avatars. If admins change nothing, public channels stay on. Admin controls (Server Settings, Web Presence) and the member switch (User Settings, Data and Privacy) are available now; the member setting is off by default in the EU, UK, Canada, Brazil, Australia and South Korea, and teen accounts are excluded.
- The Stanford Daily (October 27, 2026) reports that professors including Tobias Wolff opted out of the $1.5 billion Bartz v. Anthropic settlement, which covers nearly 500,000 registered works at about $3,000 per work, and are suing Anthropic separately, seeking a jury trial, statutory damages of up to $150,000 per work and an injunction against training on their books. The article summarizes Judge William Alsup's earlier ruling as finding training on legally acquired books fair use and building a permanent library from pirated copies not. The new suits are allegations; no ruling on their claims was found.

## Questions and answers

### What did the Tailworm report find in Tailscale SSH, and which version fixes it?

Tailscale's bulletin says its SSH server, running as root in the tailscaled process, checked Unix socket paths by their text and then did the work as root. That let an authorized session with forwarding allowed reach root-only sockets such as the Docker socket or the tailscaled local API. The fixes are in Tailscale version 1.104.4, and sockets are now forwarded as the logged-in user.

### How do I switch off SSH forwarding in Tailscale until I can update?

Tailscale's bulletin documents setting the environment variable TS\_SSH\_DISABLE\_FORWARDING to 1 in the tailscaled service environment and restarting the service. It disables forwarding without disabling Tailscale SSH entirely. Tailscale also recommends reviewing SSH access policies and updating to version 1.104.4 or newer, and says an attacker needs an existing foothold on an authorized device.

### Do git and curl on a Mac still trust the compromised eMudhra certificates?

A researcher site run by Dennis Jackson says that as of October 28 the git, curl and python3 shipped with macOS still accept certificates from the compromised eMudhra intermediates, and that macOS 27.2 did not fix it. Apple's support page confirms that tools which check the /etc/ssl/cert.pem file can still accept them until a future update, while Safari and Mail block them since October 19.

### What will Discord change for public servers, and how do admins and members opt out?

Discord says every Discoverable Server, meaning at least 1,000 members, gets a public Server Web Page on November 16, 2026, and messages from admin-allowed public channels can appear in web search from mid-December. Admins choose channels in Server Settings under Web Presence. Members can switch off their messages in User Settings under Data and Privacy; the member setting starts off in six regions.

### What was The Daily Diff's verdict on these four stories?

The Daily Diff's verdict was NEEDS REVIEW. Niko's reason is that Tailscale's fix is out but servers are not updated yet, Apple's command line gap is still open, Discord's defaults switch on November 16, and the authors' claims against Anthropic are still allegations. The advice is to update Tailscale, check your own git, review Discord settings and read the primary sources.

## Chapters

- 0:00 Cold open: a Tailscale SSH session and the root-only sockets
- 0:50 Story one: what a Tailscale SSH session could reach
- 1:43 Story two: why git on a Mac still trusts eMudhra
- 2:54 Story three: Discord moves public servers into web search
- 4:06 Story four: authors, Claude and a second lawsuit
- 5:35 Verdict: NEEDS REVIEW

## Transcript

### Cold open: a Tailscale SSH session and the root-only sockets

0:00 A Tailscale SSH login keeps you inside your own user account. A report published on Saturday describes sessions reaching sockets only root should touch, and Tailscale shipped fixes this week. In this video, four stories. What could a Tailscale SSH session reach? Why does git on a Mac still trust revoked certificates? What changes for public Discord servers on November sixteenth? And what are authors claiming in their lawsuits against Anthropic?

0:27 There is also a reason Tailscale pushes back on the name of that report. I will save it for the end. It's Wednesday, October twenty eighth, and this is The Daily Diff. Tailscale links your machines into one private network, and Tailscale SSH is its built-in SSH server, which checks your Tailscale identity instead of a key file. It runs inside a process with root privileges. Think of a doorman who also holds the master key.

### Story one: what a Tailscale SSH session could reach

0:50 Story one. Security researcher Erica Windisch tested Tailscale one point one oh four point two for three days and published a report called Tailworm. Tailscale says the report reached it on Saturday morning, and the researcher published two hours later. The main finding is socket forwarding. Tailscale's own bulletin says its SSH server runs as root, checked socket paths by their text, and then did the work as root. That gave three routes: a connection to a root-only socket,

1:16 a remote forward that deletes a root-owned socket, and a race where the kernel resolves the path again after the check. Tailscale says an attacker needs a foothold on a device already in the tailnet, with SSH and forwarding both allowed by policy. The fix is version one point one oh four point four, and forwarding now runs as the logged-in user. If you cannot update today, the bulletin documents a service setting that turns

1:42 forwarding off. Story two.

### Story two: why git on a Mac still trusts eMudhra

1:44 Last Wednesday I covered the eMudhra certificate keys, and I said the deployed client's trust still needed checking. More than a week after Apple was told, a researcher site run by Dennis Jackson says git, curl and python on a Mac still accept certificates from those intermediates. Apple's own support page describes the split. Safari, Mail and apps on Apple's networking frameworks block the certificates, and have since October nineteenth.

2:08 But command line tools such as curl, git and python read a certificate file in the system folder, and they skip Apple's block until a future update. The researcher site adds that macOS twenty seven point two, released Monday, did not fix it and undid the manual workaround. Apple's page does say an update can replace that file, and I found no date for the fix. Tailscale's bulletin on these keys, from October twenty first, explains that its client trusts whatever the system store trusts.

2:38 If you build on a Mac or run Mac CI runners, run the researchers' check against your own git, then follow Apple's steps, which remove up to two root certificates from that file. Apple warns that can break some sites, and an update can undo it, so check again after every update.

### Story three: Discord moves public servers into web search

2:54 Story three. On Tuesday Discord announced that discussions in Discoverable Servers will become easier to find in web search. Those are its most public servers, with at least a thousand members, and Discord counts more than sixty three thousand of them. Here are the dates. Admin and member controls started rolling out Tuesday. On November sixteenth every Discoverable Server gets a public web page, and automated channel summaries can start appearing on it.

3:18 From mid December, messages from public channels can show in web search too, without usernames or avatars, if the server's admins allow it. The defaults matter. If an admin changes nothing, public channels stay on. Members get a switch in Data and Privacy settings. It starts on in most places and off by default in six, including the European Union and the United Kingdom. Teen accounts are excluded, and messages from before mid December do not count.

3:48 Two details to watch. The member switch covers messages, while channel summaries are generated separately and stay on unless an admin turns them off. And a message sent while the switch was on stays up unless you delete it. If you run a community, open Web Presence in server settings before November sixteenth. Story four, and I will stick to what is documented.

### Story four: authors, Claude and a second lawsuit

4:08 On October twenty sixth I covered the Anthropic filing, which lists a one point five billion dollar settlement with authors. The Stanford Daily reports that professors including Tobias Wolff opted out of that settlement and are suing separately. According to the Daily, the settlement works out to about three thousand dollars per work, across nearly five hundred thousand works. The opt-out suit asks a jury for statutory damages of up to one hundred fifty thousand dollars per work, fifty times more, plus an order against training on

4:37 the plaintiffs' books. The ruling underneath is narrower than the headline. Judge Alsup found that training on legally acquired books was fair use, and that building a permanent library from pirated copies was not. The new suits allege pirated copies, and I found no ruling on their claims. In September, the OpenAI LibGen files raised the same question about another lab. If you assemble training data, keep a record of where each file came from. The ruling separated legally acquired books from pirated copies,

5:07 so the source of the copies is the question you will be asked. Back to the name. Tailscale says nothing in the report spreads on its own. It calls the path lateral movement, limited to connections the tailnet policy already allows, and only from a device the attacker already holds. The researcher's page replies that the flaws were found with low effort. Both can be true, and the fix is out either way. If you'd rather read this than hear me say it, the diff lands in your inbox

5:31 every morning, free at the daily diff dot dev, link below. So today's verdict is NEEDS REVIEW.

### Verdict: NEEDS REVIEW

5:37 I'd review it because Tailscale's fix is out but your servers are not updated yet, Apple's command line gap is still open, Discord's defaults switch on November sixteenth, and the authors' claims are still allegations. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

## Sources

- [Tailscale SSH: Findings and fixes](https://tailscale.com/blog/tailscale-ssh-findings-fixes) — Tailscale
- [Tailscale SSH: Investigation and remediation update](https://tailscale.com/ssh-investigation-update) — Tailscale
- [Tailscale security bulletins](https://tailscale.com/security-bulletins) — Tailscale
- [Tailworm: Tailscale vulnerabilities](https://tailworm.com/) — Cyberdione Labs (Erica Windisch)
- [Apple's git still trusts the compromised eMudhra certificates](https://emudhra.we-have-a-problem.com/apple.html) — Dennis Jackson and contributors
- [About the compromised eMudhra intermediate CAs](https://support.apple.com/en-us/149555) — Apple Support
- [Making Content from Discoverable Servers Easier to Discover](https://discord.com/blog/making-content-from-discoverable-servers-easier-to-discover) — Discord
- [Anthropic illegally trained Claude with Stanford professors' books](https://stanforddaily.com/2026/10/27/professors-books-pirated-to-train-claude/) — The Stanford Daily