Today's thread
Today's news runs in two directions. One is the security debt piling up in server and network tools while we build services quickly with AI. Tailscale's flaws went public before a fix was out, while Node.js has already shipped its fixes. Neither ends with a single update: you first need to see whether your own setup meets the conditions.
The other is getting more out of the same money. A tool that boosts the AI compute speed of an RTX 4090 you already own, coding AI models opened up for a limited time, and Naver and Daangn search ads that will no longer let bids alone buy rank all fit here. In each case there is a gap between the published numbers and the real effect on your work, so measuring it yourself is still the job.
Tailscale: 11 flaws disclosed before a patch — tighten SSH rules first
On October 25, the security lab Cyberdione Labs published the ‘Tailworm’ report disclosing 11 flaws in Tailscale 1.104.2 and headscale 0.29.5. Tailscale ties company computers and servers into one private network (a tailnet) over the internet, and headscale is an open-source version that lets you run the control server yourself. The most serious flaw is that port forwarding in Tailscale SSH (its remote-access feature), which extends a connection to another destination, runs with administrator rights (root). The report claims an attacker who already controls one device on the network can gain administrator rights on other servers.
The researcher published without coordinating a disclosure date with the company. As of this writing, the newest release in Tailscale's official changelog is 1.104.2 from October 21, and there is still no CVE, the shared ID assigned to security flaws. Tailscale said it received the report, has been reviewing the same areas with outside experts, and is fixing the issues. According to the report, some fixes have already been merged into the public code repositories, and Tailscale aims to ship a patched release within the 27th, subject to testing.
The key point is that the conditions are narrow. This is not a flaw anyone on the internet can exploit: one device permitted by the access rules must be compromised first, and those rules must allow forwarding. If you have never turned on Tailscale SSH, the main flaw affects you little. If instead you have broad rules where every device can reach every server, narrow them now. On headscale 0.29.5, where forwarding cannot be turned off, treat every SSH permission as equal to administrator rights.
The report advises splitting SSH rules into device-to-server pairs, denying forwarding, and removing root as a target. It adds that with Tailnet Lock off, the default (it requires new devices to be signed by a trusted device), an attacker can slip in a fake device. Enable it under Device management in the admin console with at least two signing devices; Android cannot sign yet. Its 10 disablement secrets appear only once and losing them makes the network unrecoverable, so save them in a password manager. The results are lab reproductions, not yet verified by a third party.
Node.js October security release — 10 flaws fixed across 22, 24 and 26
On October 21, Node.js released 26.12.1, 24.22.1 and 22.23.4, fixing 10 security flaws (4 high, 3 medium, 3 low). Node.js is the runtime that runs JavaScript web services and automation scripts on servers, and many in-house tools built with AI rely on it. The most serious is a flaw in decoding the Brotli compression format: receiving crafted compressed data can crash the program, leak memory contents, or let commands run remotely.
The other three high-severity flaws involve certificate checks and address lookups. Examples include reading IP addresses written with full-width digits or leading zeros differently and accepting the wrong certificate, or truncating an address containing a special character mid-name and connecting somewhere else. Node.js says end-of-life versions are always affected by security releases and recommends moving to a supported version.
In-house tools built quickly with AI often run for months on whatever Node.js version was first installed. Run node -v on the server and upgrade if it is below 26.12.1, 24.22.1 or 22.23.4. For services built by a contractor, the quickest route is to send them these three version numbers and ask for an update schedule.
gpu-unlock-ada doubles RTX 4090 peak AI math — real work gains 12–34%
A Linux tool that lifts the AI compute limit on graphics cards now covers the RTX 40 series. The public repository gpu-unlock-ada is a Linux kernel module, a part plugged into the core of the operating system, that changes card settings before NVIDIA's stock driver loads. In the author's measurements, the RTX 4090's FP16 tensor throughput doubled from 165.6 to 331.6 trillion operations per second, and BF16 from 165.5 to 330.6 trillion. Tensor operations are the matrix multiplications that make up most of the work when an AI model runs, and FP16 and BF16 are the number formats used for them.
The gpu-unlock covered yesterday targeted the RTX 30 series; this repository mainly targets the RTX 4090, with cards such as the 4070 Ti SUPER requiring separate opt-in as experimental. Another owner's measurement was similar, from 160.4 to 320.4 trillion FP16 operations per second. But that figure is the peak rate of issuing compute instructions; in tests with the real matrix-multiplication library (cuBLAS), speedups were only 12–34% depending on matrix shape. A test actually running a compressed large model showed no speedup.
For teams that keep an RTX 4090 in the office and run AI models themselves, this is worth trying before buying a new card. Because the effect varies widely by task, pick one task you run now, time it before and after, and decide from that.
The limits are clear. The author describes it as research, and each card type was confirmed on only one or two units. A cold boot with the power fully off is needed before the first attempt, and the author advises keeping a separate boot entry for the original state. The module is GPL-2.0, but NVIDIA firmware stays under NVIDIA's terms, so check company policy first on work machines.
Naver and Daangn search ads: click likelihood over bids from November
On November 4, Naver's advertiser center changes its name and logo to Naver Ads (N Ads). Addresses, accounts, ads, budgets, Bizmoney and coupons stay the same, the AI support chatbot becomes ‘Ads Assistant’, and a guide for first-time advertisers is added. From November 25, a Click Expectation Index arrives for mall-product and product-catalog creatives in shopping search ads. It scores each creative from 1 to 10 based on past click-through rates, and the existing quality index for these types will no longer be provided.
Daangn will also change how it ranks all search ads in both Simple and Expert modes from November 9. On top of ad quality, bid and keyword relevance, it will factor in how likely that user is to actually respond to an ad. So the same keyword can show different ads to different people, and raising your bid no longer guarantees the rank you want. The amount actually charged per click will not exceed the bid you set.
Both changes point the same way. Rather than spending more to buy a spot, product names, photos and prices that people want to tap, and the page they land on after clicking, matter more. Naver's index is a reference score that does not itself decide exposure or rank, so use it to choose which creative to fix first. Sellers who have been generating several versions of product names and descriptions with AI now get a number to read the results.
Daangn has not disclosed how the score is calculated. Whether ad spend falls or exposure rises can only be known from real results after launch, so record two weeks of click-through rate and cost per click now, before the change.
opencode adds limited-time free DeepSeek V4.1 Flash and GLM-5.3-Flash
Zen, the model service of the open-source AI coding tool opencode, lists DeepSeek V4.1 Flash Free and GLM-5.3-Flash Free as free models for a limited time. Their model IDs are deepseek-v4.1-flash-free and glm-5.3-flash-free, and no end date is given. Like Claude Code, opencode has AI write code from a terminal, a window where you type commands as text.
The official docs say these two models do not retain conversations and the providers do not use them for training. By contrast, others on the same list, such as Big Pickle and MiMo-V2.6-Flash Free, say they may use data collected during the free period to improve the model, so free models do not all come with the same terms. To hide free models entirely, set the environment variable (a setting handed to a program in advance) OPENCODE_DISABLE_FREE_MODELS=1.
If your subscription usage is tight, routing simple screen tweaks or script drafts here can save your paid quota. Before feeding in company code or customer data, though, recheck each model's data terms in the docs.
The docs do not say where the free models are processed, and nobody knows when the free period ends. Rather than locking your workflow around the free period, keep your setup ready to switch to another model at any time.
Try today
Open the SSH section of the access rules in the Tailscale admin console and check for lines that open every device to every server, or that target root. If you have never used Tailscale SSH, just confirm that section is empty.
Run node -v on the servers running your services and confirm they are at 26.12.1, 24.22.1 or 22.23.4 or later. For contractor-built services, send these three numbers to the vendor and get an update date.
If you run Naver or Daangn ads, put the last two weeks of click-through rate and cost per click in one table. Comparing with the same table after November 9 and 25 will show the effect of the new rules in numbers.
If you use opencode, check that the two free models appear in the /models list, and try them first on a practice project rather than company code.