Security advisories
Incidents that reach the hosts and projects Swamp users run, each with a Swamp extension that checks whether you are affected.
Tailworm
Lab-reproduced flaws in Tailscale SSH, serve and app connectors, and in headscale, let any device an SSH rule admits reach root-only sockets on the node.
HTTP2Shell
An out-of-bounds write in Google's C Brotli decoder lets a crafted request body or response crash, leak memory from or run code in Node.js, Python, Envoy and Bun.
eMudhra CA compromise
Recoverable private keys for eight eMudhra intermediate CAs let anyone forge a certificate for any domain that a non-CT client still trusts.
PHP remote code execution
Two critical bugs in PHP's request handling, CVE-2026-109618 and CVE-2026-109619, allow unauthenticated remote code execution on PHP that serves web requests.
Mini Shai-Hulud
An npm supply chain attack that compromised 314 packages through a hijacked maintainer account.
Dirty Frag
A Linux kernel local privilege escalation chain through xfrm-ESP and RxRPC that corrupts the page cache.