Tailscale's SSH bugs sat after authorisation, and it rejects the worm label
Tailscale shipped v1.104.4 on 28 October with fixes for privilege-boundary bugs in Tailscale SSH and three Serve bugs. The flaws were about what a session could do after it was authorised, not who could connect, and Tailscale argues the 'Tailworm' framing overstates them: exploitation needs an existing foothold in the tailnet and SSH permitted by policy.