5 dispatches · latest 13 SEP 2026 · all keywords →
No exposed edge port, no NAT hairpinning — Headscale gives you an encrypted WireGuard mesh to your whole lab from any device, with split DNS that actually resolves on mobile. v0.29 is a breaking release; here's how to land on v0.29.3 cleanly.
An unauthenticated auth bypass in Citrix NetScaler ADC/Gateway landed on CISA's KEV catalog with a Sep 12 due date and a forensic-triage requirement. The vendor published exact config strings to grep before you patch.
Two GL.iNet routers and a port forward turn any hotel or airport network into an encrypted pipe to your home LAN — your phone keeps its home IP, no third-party VPN subscription required.
IXON's OT-focused VPN client writes config from a local endpoint that checks no credentials, then feeds it to a root subprocess with CRLF un-neutralized. CVSS 9.6 — and the injected config survives reboots while your VPN keeps working perfectly.
CVE-2026-83548 is a pre-auth CVSS 10.0 SSRF in the SMA1000 Work Place interface that chains with post-auth command injection into unauth RCE on internet-facing remote-access gateways. Exploited in the wild, KEV due date Sep 5.