What broke. Tailscale is a mesh VPN built on WireGuard that links a company's laptops, servers and cloud machines into one private network. Tailscale SSH lets people log in to those machines based on device identity and access rules instead of passwords or keys. Per the report, as summarized by SecurityWeek, Tailscale SSH does some forwarding work with root privileges, and the guardrails meant to limit it can be bypassed. Six of the 11 findings are rated high severity, and four of those hit Tailscale SSH.
Why "worm" fits. In lab tests the researchers chained the SSH bugs automatically: from one compromised machine to every server the access policy let it SSH into, at under a second per hop, with no user clicking anything. They also stole keys that could add rogue devices to the network. The first foothold would still have to come from somewhere ordinary, like a phished laptop, a vulnerable web app or a malicious package. Other findings hit the app connector, Serve, headscale and the relay component, and could reach cloud metadata services, expose a node's admin interface or crash things.
Tailscale's side. VP of Engineering Mike Shaver said most issues concern what an already-authorized session can do, not an outsider connecting to arbitrary machines, and that impact depends on how SSH access is set up. Tailscale is not telling everyone to switch off Tailscale SSH. Fixes for several findings have landed in its public code, but none were in a numbered release yet. Neither Tailscale nor the report mentions attacks in the wild. The report went out before patches, which drew criticism; the researchers argue fast awareness speeds up fixes.
What I'd do today. Find which access rules grant Tailscale SSH and turn off SSH forwarding anywhere it isn't needed, which Tailscale says blunts several of the worst findings. Tighten who can SSH where, so one laptop can't reach every server. Watch for the patched client tonight and push it to servers first. If you run headscale, track its fixes separately, since it is a different project.