Alpine Linux fixes SSH flaw that can expose passwordless accounts in some setups
Alpine Linux shipped fixed OpenSSH packages for a bug that can let attackers enter passwordless accounts if password logins are enabled and another local account has a qualifying hash. The…
#cybersecurity #opensource
Alpine Linux shipped fixed OpenSSH packages for a bug that can let attackers enter passwordless accounts if password logins are enabled and another local account has a qualifying hash. The…
#cybersecurity #opensource
Alpine Linux fixes SSH flaw that can expose passwordless accounts in some setups
Alpine Linux shipped fixed OpenSSH packages for a bug that can let attackers enter passwordless accounts if password logins are enabled and another local account has a qualifying hash. The service must also be restarted.
secquill.com
November 8, 2026 at 2:35 AM
Alpine Linux fixes SSH flaw that can expose passwordless accounts in some setups
Alpine Linux shipped fixed OpenSSH packages for a bug that can let attackers enter passwordless accounts if password logins are enabled and another local account has a qualifying hash. The…
#cybersecurity #opensource
Alpine Linux shipped fixed OpenSSH packages for a bug that can let attackers enter passwordless accounts if password logins are enabled and another local account has a qualifying hash. The…
#cybersecurity #opensource
Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)
Main Link | Techmeme Permalink
Main Link | Techmeme Permalink
November 6, 2026 at 4:30 PM
Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)
Main Link | Techmeme Permalink
Main Link | Techmeme Permalink
Worth flagging the scope: it needs musl plus OpenSSH without PAM and a passwordless account, so it is not every Linux box. But Alpine is everywhere in containers, so check the base image, not just the host.
November 5, 2026 at 11:17 PM
Worth flagging the scope: it needs musl plus OpenSSH without PAM and a passwordless account, so it is not every Linux box. But Alpine is everywhere in containers, so check the base image, not just the host.
Alpine Linux SSH gets an easy backdoor
A decade-old vulnerability allows passwordless SSH login on specific Alpine Linux configurations by entering over 256 characters as a password. Alpine maintainers confirmed it's a "one connection" exploit.
A decade-old vulnerability allows passwordless SSH login on specific Alpine Linux configurations by entering over 256 characters as a password. Alpine maintainers confirmed it's a "one connection" exploit.
November 6, 2026 at 7:00 AM
Alpine Linux SSH gets an easy backdoor
A decade-old vulnerability allows passwordless SSH login on specific Alpine Linux configurations by entering over 256 characters as a password. Alpine maintainers confirmed it's a "one connection" exploit.
A decade-old vulnerability allows passwordless SSH login on specific Alpine Linux configurations by entering over 256 characters as a password. Alpine maintainers confirmed it's a "one connection" exploit.
OpenSSH Flaw Enables Passwordless Logins on Alpine Linux
A flaw in OpenSSH can let attackers log in to passwordless accounts on certain Alpine Linux and other musl-based systems. OpenSSH 10.6p2 and Alpine packages now fix the issue.
A flaw in OpenSSH can let attackers log in to passwordless accounts on certain Alpine Linux and other musl-based systems. OpenSSH 10.6p2 and Alpine packages now fix the issue.
OpenSSH Flaw Enables Passwordless Logins on Alpine Linux
A flaw in OpenSSH can let attackers log in to passwordless accounts on certain Alpine Linux and other musl-based systems. OpenSSH 10.6p2 and Alpine packages now fix the issue.
www.abijita.com
November 6, 2026 at 2:36 AM
OpenSSH Flaw Enables Passwordless Logins on Alpine Linux
A flaw in OpenSSH can let attackers log in to passwordless accounts on certain Alpine Linux and other musl-based systems. OpenSSH 10.6p2 and Alpine packages now fix the issue.
A flaw in OpenSSH can let attackers log in to passwordless accounts on certain Alpine Linux and other musl-based systems. OpenSSH 10.6p2 and Alpine packages now fix the issue.
#Passwordless registration flows are great until your not very computer savvy neighbor sign themselves up for a service with monthly charges and no one has a clue about how to cancel the shit because we don't even know the account ID, we only see the charges on the bank
1/2
1/2
November 8, 2026 at 4:17 PM
#Passwordless registration flows are great until your not very computer savvy neighbor sign themselves up for a service with monthly charges and no one has a clue about how to cancel the shit because we don't even know the account ID, we only see the charges on the bank
1/2
1/2
incredibly funny vulnerability
basically, musl crypt() doesn’t support passwords bigger than 256 characters for DoS-prevention reasons. if it runs into one of them it returns “\*” as its hash
the problem is that “\*” is the placeholder hash for passwordless accounts
basically, musl crypt() doesn’t support passwords bigger than 256 characters for DoS-prevention reasons. if it runs into one of them it returns “\*” as its hash
the problem is that “\*” is the placeholder hash for passwordless accounts
the industry that brought you "4 is a perfectly good secret prime number, right?" has now innovated with "hey, if an account has no password set (so no one can log in), any password longer than 256 characters means you can log into it, right?"
sshhole.com
sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 6, 2026 at 4:35 PM
incredibly funny vulnerability
basically, musl crypt() doesn’t support passwords bigger than 256 characters for DoS-prevention reasons. if it runs into one of them it returns “\*” as its hash
the problem is that “\*” is the placeholder hash for passwordless accounts
basically, musl crypt() doesn’t support passwords bigger than 256 characters for DoS-prevention reasons. if it runs into one of them it returns “\*” as its hash
the problem is that “\*” is the placeholder hash for passwordless accounts
The roundup reports 20 exploitation attempts from 13 IPs against OpenSSH CVE-2026-123158 (SSHole), which can enable sign-ins to passwordless accounts on Linux systems using musl with PAM disabled, and lists other vulnerabilities.
Weekly Recap: OpenSSH SSHole Exploitation Attempts and Other Vulnerabilities
The roundup reports 20 exploitation attempts from 13 IPs against OpenSSH CVE-2026-123158 (SSHole), which can enable sign-ins to passwordless accounts on…
cyber.hendryadrian.com
November 9, 2026 at 4:00 PM
The roundup reports 20 exploitation attempts from 13 IPs against OpenSSH CVE-2026-123158 (SSHole), which can enable sign-ins to passwordless accounts on Linux systems using musl with PAM disabled, and lists other vulnerabilities.
SITREP: Critical OpenSSH 'SSHOLE' (CVE-2026-123158) under active exploitation. Passwordless root possible on Alpine Linux. Patch now.
#Cybersecurity #Anonymous #Vulnerability
#Cybersecurity #Anonymous #Vulnerability
AnonNews_irc
We Are Anonymous
We Do Not Forget
Expect us
anon-news-irc.wuaze.com
November 9, 2026 at 3:29 PM
SITREP: Critical OpenSSH 'SSHOLE' (CVE-2026-123158) under active exploitation. Passwordless root possible on Alpine Linux. Patch now.
#Cybersecurity #Anonymous #Vulnerability
#Cybersecurity #Anonymous #Vulnerability
OpenSSH flaw CVE-2026-123158 exploited hours after disclosure.
Attackers target infrastructure running passwordless setups. Understand the risk before your next deployment.
Attackers target infrastructure running passwordless setups. Understand the risk before your next deployment.
November 8, 2026 at 12:03 AM
OpenSSH flaw CVE-2026-123158 exploited hours after disclosure.
Attackers target infrastructure running passwordless setups. Understand the risk before your next deployment.
Attackers target infrastructure running passwordless setups. Understand the risk before your next deployment.
If you use @EdGrosvenor’s wonderful Passwordless Login package (https://github.com/edalzell/laravel-passwordless-login), please upgrade.
I just published two security advisories: https://github.com/edalzell/laravel-passwordless-login/security/advisories/GHSA-4wf6-gqv9-mw65 & […]
I just published two security advisories: https://github.com/edalzell/laravel-passwordless-login/security/advisories/GHSA-4wf6-gqv9-mw65 & […]
Original post on cosocial.ca
cosocial.ca
November 3, 2026 at 6:10 PM
If you use @EdGrosvenor’s wonderful Passwordless Login package (https://github.com/edalzell/laravel-passwordless-login), please upgrade.
I just published two security advisories: https://github.com/edalzell/laravel-passwordless-login/security/advisories/GHSA-4wf6-gqv9-mw65 & […]
I just published two security advisories: https://github.com/edalzell/laravel-passwordless-login/security/advisories/GHSA-4wf6-gqv9-mw65 & […]
Fact or Fiction: Passkeys can't be phished.
Mostly fact. A passkey is bound to the real site, so a fake login page has nothing to steal. Passwordless works best when the whole access journey is protected, not just the login screen.
Mostly fact. A passkey is bound to the real site, so a fake login page has nothing to steal. Passwordless works best when the whole access journey is protected, not just the login screen.
November 9, 2026 at 10:58 PM
Fact or Fiction: Passkeys can't be phished.
Mostly fact. A passkey is bound to the real site, so a fake login page has nothing to steal. Passwordless works best when the whole access journey is protected, not just the login screen.
Mostly fact. A passkey is bound to the real site, so a fake login page has nothing to steal. Passwordless works best when the whole access journey is protected, not just the login screen.
OpenSSH vulnerability exploited within hours of disclosure (CVE-2026-123158)（OpenSSHの脆弱性が公表からわずか数時間後に実際に悪用される（CVE-2026-123158）） #Help Net Security (Nov 6)
www.helpnetsecurity.com/2026/11/06/o...
www.helpnetsecurity.com/2026/11/06/o...
OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) - Help Net Security
Exploitation of sshole (CVE-2026-123158), an OpenSSH bug that opens passwordless Alpine Linux accounts, began within nine hours of disclosure.
www.helpnetsecurity.com
November 9, 2026 at 2:38 AM
OpenSSH vulnerability exploited within hours of disclosure (CVE-2026-123158)（OpenSSHの脆弱性が公表からわずか数時間後に実際に悪用される（CVE-2026-123158）） #Help Net Security (Nov 6)
www.helpnetsecurity.com/2026/11/06/o...
www.helpnetsecurity.com/2026/11/06/o...
a decade-old ssh edge case that turns a long password into a login on passwordless accounts is a boundary bug. the fix is rejecting the overflow path before auth, not hoping clients never send it.
November 6, 2026 at 6:51 PM
a decade-old ssh edge case that turns a long password into a login on passwordless accounts is a boundary bug. the fix is rejecting the overflow path before auth, not hoping clients never send it.
Hundreds of publicly exposed Artex deployments enable passwordless web access to an autonomous AI penetration testing tool, increasing risk of misuse and cyberattacks.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
November 6, 2026 at 6:54 PM
Hundreds of publicly exposed Artex deployments enable passwordless web access to an autonomous AI penetration testing tool, increasing risk of misuse and cyberattacks.
Hundreds of publicly exposed Artex deployments enable passwordless web access to an autonomous AI penetration testing tool, increasing risk of misuse and cyberattacks.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
November 6, 2026 at 6:54 PM
Hundreds of publicly exposed Artex deployments enable passwordless web access to an autonomous AI penetration testing tool, increasing risk of misuse and cyberattacks.
Hundreds of publicly exposed Artex deployments enable passwordless web access to an autonomous AI penetration testing tool, increasing risk of misuse and cyberattacks.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
November 6, 2026 at 6:54 PM
Hundreds of publicly exposed Artex deployments enable passwordless web access to an autonomous AI penetration testing tool, increasing risk of misuse and cyberattacks.
AI-generated · Entra is rolling out GA so users can register a passkey or passwordless sign‑in as their first MFA. Phase 1 runs early Nov–early Jan; Phase 2 completes by late Feb ’27. Pilot now: enable the Passkey (FIDO2) policy and verify iOS 17/Android 14 device support.
Entra lets passkeys be the first MFA method, GA rollout begins
Microsoft has started a general availability rollout that lets users register a passkey or passwordless sign-in as their first MFA method. Per MC1450133, Phase 1 runs from early November 2026 to early January 2027, with Phase 2 completing by late February 2027.
kira-ai.de
November 8, 2026 at 5:45 PM
AI-generated · Entra is rolling out GA so users can register a passkey or passwordless sign‑in as their first MFA. Phase 1 runs early Nov–early Jan; Phase 2 completes by late Feb ’27. Pilot now: enable the Passkey (FIDO2) policy and verify iOS 17/Android 14 device support.
A password over 256 bytes could log an attacker into passwordless accounts over SSH on Alpine Linux.
its wild we get these every day. its patched but you gotta update
its wild we get these every day. its patched but you gotta update
November 6, 2026 at 12:03 AM
A password over 256 bytes could log an attacker into passwordless accounts over SSH on Alpine Linux.
its wild we get these every day. its patched but you gotta update
its wild we get these every day. its patched but you gotta update
We’re teaming up with RJ Lee Group to bring #quantumsafe #cybersecurity solutions to the #PublicSector. Discover how their portfolio combines post-quantum data protection with phishing-resistant, #passwordless authentication: https://carah.io/RJLeeGroupPR
November 5, 2026 at 3:30 PM
We’re teaming up with RJ Lee Group to bring #quantumsafe #cybersecurity solutions to the #PublicSector. Discover how their portfolio combines post-quantum data protection with phishing-resistant, #passwordless authentication: https://carah.io/RJLeeGroupPR
thankfully it’s only vulnerable under a limited set of circumstances (musl, openssh, no PAM, password auth enabled for at least one account, passwordless root account)
unfortunately those circumstances include “the default Alpine Linux images for Azure and AWS”
unfortunately those circumstances include “the default Alpine Linux images for Azure and AWS”
November 6, 2026 at 4:39 PM
thankfully it’s only vulnerable under a limited set of circumstances (musl, openssh, no PAM, password auth enabled for at least one account, passwordless root account)
unfortunately those circumstances include “the default Alpine Linux images for Azure and AWS”
unfortunately those circumstances include “the default Alpine Linux images for Azure and AWS”