New blog post:
*sshole, or when are we finally going to get rid of C?
Bad type systems feed into bad engineering norms.
sunshowers.io
November 6, 2026 at 10:29 PM
New blog post:
she really is an @sshole
November 9, 2026 at 1:43 AM
she really is an @sshole
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]
www.bleepingcomputer.com
November 9, 2026 at 4:32 PM
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
> The engineering norms of C developers allow for "*" to be an acceptable sentinel value indicating an error; the engineering norms of Rust developers simply do not.
Yeah, this is the heart of it honestly.
(From the end of: sunshowers.io/posts/sshole/ via @sunshowers.io)
Yeah, this is the heart of it honestly.
(From the end of: sunshowers.io/posts/sshole/ via @sunshowers.io)
*sshole, or when are we finally going to get rid of C?
Bad type systems feed into bad engineering norms.
sunshowers.io
November 7, 2026 at 1:32 AM
> The engineering norms of C developers allow for "*" to be an acceptable sentinel value indicating an error; the engineering norms of Rust developers simply do not.
Yeah, this is the heart of it honestly.
(From the end of: sunshowers.io/posts/sshole/ via @sunshowers.io)
Yeah, this is the heart of it honestly.
(From the end of: sunshowers.io/posts/sshole/ via @sunshowers.io)
she * on my sshole till my SSH opens
November 9, 2026 at 12:15 PM
she * on my sshole till my SSH opens
Under certain conditions, Linux systems that use OpenSSH, as well as the code library known as musl, can be hacked to give unauthenticated access to high-privilege accounts in a matter of seconds: arstechnica.visitlink.me/-wi5JV
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
sshole" poses a serious threat to Internet security.
arstechnica.visitlink.me
November 10, 2026 at 4:35 PM
Under certain conditions, Linux systems that use OpenSSH, as well as the code library known as musl, can be hacked to give unauthenticated access to high-privilege accounts in a matter of seconds: arstechnica.visitlink.me/-wi5JV
CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerabilityhttps://cybersecuritynews.com/hackers-exploiting-sshole-the-openssh-bug/
CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability
CISA warned of active exploitation of SSHole an OpenSSH flaw allowing passwordless access to certain Linux accounts.
cybersecuritynews.com
November 10, 2026 at 2:00 PM
CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerabilityhttps://cybersecuritynews.com/hackers-exploiting-sshole-the-openssh-bug/
Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.
Listen/Read: hackread.com/hackers-expl...
#CyberSecurity #SSHole #OpenSSH #Backdoor #Linux
Listen/Read: hackread.com/hackers-expl...
#CyberSecurity #SSHole #OpenSSH #Backdoor #Linux
Hackers Exploit Decade-Old OpenSSH Flaw to Bypass Linux Logins
Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.
hackread.com
November 11, 2026 at 7:30 AM
Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.
Listen/Read: hackread.com/hackers-expl...
#CyberSecurity #SSHole #OpenSSH #Backdoor #Linux
Listen/Read: hackread.com/hackers-expl...
#CyberSecurity #SSHole #OpenSSH #Backdoor #Linux
We are in the golden age of stupid vulnerabilities and this is the stupidest one I have seen this year: sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 6, 2026 at 12:24 PM
We are in the golden age of stupid vulnerabilities and this is the stupidest one I have seen this year: sshhole.com
ARE YOU FUCKING KIDDING ME sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 6, 2026 at 5:34 AM
ARE YOU FUCKING KIDDING ME sshhole.com
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.
www.bleepingcomputer.com
November 9, 2026 at 4:05 PM
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.
Discuss on HN (thanks hasheddan -- not sure who you are haha)
*sshole, or when are we going to get rid of C? | Hacker News
news.ycombinator.com
November 6, 2026 at 10:43 PM
Discuss on HN (thanks hasheddan -- not sure who you are haha)
Not great that the overwhelming subject of lobsters’ discussion on *sshole is the LLM generated website and not the vulnerability or software practices that led to it
November 6, 2026 at 10:51 AM
Not great that the overwhelming subject of lobsters’ discussion on *sshole is the LLM generated website and not the vulnerability or software practices that led to it
it feels like a parody of that *sshole site
November 10, 2026 at 7:18 PM
it feels like a parody of that *sshole site
Une faille critique dans l'écosystème Linux permet de contourner l'authentification SSH et d'obtenir un accès non autorisé à des machines. Baptisée #sshole, elle est déjà exploitée activement . Décryptage des risques et des enjeux 👇
*sshole - Une faille OpenSSH exploitée activement et l’authentification Linux perd pied
romain.leaflet.pub
November 9, 2026 at 8:19 PM
Une faille critique dans l'écosystème Linux permet de contourner l'authentification SSH et d'obtenir un accès non autorisé à des machines. Baptisée #sshole, elle est déjà exploitée activement . Décryptage des risques et des enjeux 👇
I see we're doing another round of "blame *sshole on C"; never mind that common Rust libraries routinely make choices with comparable potential to generate dangerous parser differentials
November 7, 2026 at 10:50 AM
I see we're doing another round of "blame *sshole on C"; never mind that common Rust libraries routinely make choices with comparable potential to generate dangerous parser differentials
On est passé à **UN** caractère d’une debian-pocalypse avec *sshole… 😅
November 6, 2026 at 12:51 PM
On est passé à **UN** caractère d’une debian-pocalypse avec *sshole… 😅
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices arstechnica.com/security/202...
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Certain configurations of Alpine are affected. Other distros may be as well.
arstechnica.com
November 8, 2026 at 2:42 AM
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices arstechnica.com/security/202...
Me and @secitup.bsky.social ended up covering a LOT of different ground in this episode. We put some cold water on the "OMG, it's in the KEV list now" for *sshole. Then we get some nuanced takes on the Jensen Huang situation and what it might mean for enterprise security.
NVIDIA's CEO admits to an affair with a suspected Chinese spy. We break down what's confirmed vs. alleged, plus the SSH bug now being exploited in a honeypot + the AI bubble. w/ @malwarejake.bsky.social @secitup.bsky.social
Watch: youtu.be/223Wzv3TDQg
Watch: youtu.be/223Wzv3TDQg
November 9, 2026 at 5:28 PM
Me and @secitup.bsky.social ended up covering a LOT of different ground in this episode. We put some cold water on the "OMG, it's in the KEV list now" for *sshole. Then we get some nuanced takes on the Jensen Huang situation and what it might mean for enterprise security.
So the newly-discovered *sshole vulnerability is disgustingly bad. Patch your stuff, disable ssh if you don't need it (this affects embedded/container distros, mostly) and use bastions/jumphosts if you can!
sshhole.com
sshhole.com
*sshole · sshhole.com
openssh on musl linux has been letting people into password-less accounts since 2016.
sshhole.com
November 6, 2026 at 4:45 PM
So the newly-discovered *sshole vulnerability is disgustingly bad. Patch your stuff, disable ssh if you don't need it (this affects embedded/container distros, mostly) and use bastions/jumphosts if you can!
sshhole.com
sshhole.com