GoKawiil
Tech News
Firezone has released sanstun, a Rust implementation of the WireGuard state machine built using the sans-IO design pattern, which separates network IO, time handling and randomness from core logic. The company says it developed sanstun after years of patching boringtun, its previous WireGuard dependency, to meet evolving product needs while trying to maintain API compatibility upstream.
Security researchers at Cyberdione Labs identified 11 vulnerabilities, collectively dubbed Tailworm, in Tailscale 1.104.2 and self-hosted headscale v0.29.5 that remain unpatched. The most severe flaw lies in Tailscale's embedded SSH server, where unix-socket forwarding bugs could let an authorized device gain root-level code execution, steal enrollment keys, or delete arbitrary root files on a target machine. Founder Erica Windisch said the issues were confirmed in a lab using unmodified released software and were disclosed publicly to speed up fixes.
Tailscale published a technical update on performance work across its network, including multi-queue support for app connectors, subnet routers, and exit nodes expected in the second half of 2026. The company also previewed throughput and memory overhead improvements coming to upcoming stable client releases, building on prior gains such as 10Gb/s wireguard-go throughput and 4x UDP throughput via segmentation offloads.
Proxylity introduced DTLS Listeners, a new capability that adds TLS-style encryption and authentication to UDP-based applications without altering their datagram structure. The service handles DTLS 1.2 or 1.3 session negotiation, decrypts incoming data, and forwards plaintext to configured Destinations, encrypting responses before sending them back to the client. Each Listener automatically receives a Proxylity-managed server certificate accessible via a CloudFormation attribute.
A developer released wg-admin, a self-hosted web interface designed to manage WireGuard VPN servers that are already configured and running. Rather than generating new configs or replacing wg-quick, it reads existing files in /etc/wireguard, lets admins add, rename, rotate or remove peers, and applies changes using wg syncconf so the tunnel doesn't restart. It also generates client config files and QR codes, shows live handshake and traffic data, and backs up configs before writing changes.
Tailscale has launched tailcat, an open-source Go package and CLI tool that lets developers move data between two points using the company's underlying network technology—WireGuard encryption, NAT traversal, and DERP relay servers—without any of Tailscale's account system, control plane, or administrative layer. It functions like the classic netcat utility but routes traffic through Tailscale's magicsock networking stack, and can run entirely independent of Tailscale as a company if users host their own DERP relay server.
Tailscale released Tailcat, a CLI and Go library that reuses pieces of Tailscale's data plane to create encrypted point-to-point connections like netcat, but without needing Tailscale's control plane or a user account. One machine runs a server and generates a short connection token, which the other side uses to connect; traffic is WireGuard-encrypted and initially routed through DERP relays before attempting a direct peer-to-peer upgrade via NAT traversal.
Proton VPN is promoting its free plan as offering unlimited data and speeds with no ads, no activity logging, and protection under Swiss privacy law. The free tier is limited to one device and lacks streaming-optimized servers and the Stealth protocol, which remain reserved for paid subscribers.