A newly disclosed OpenSSH vulnerability, nicknamed SSHole, is already being exploited in the wild. The flaw, tracked as CVE-2026-123158 and carrying a CVSS score of 8.1, lets unauthenticated attackers log in to certain Linux accounts that have no usable password set. Security firm Previdian observed the first exploitation attempt less than nine hours after the vulnerability was published, and confirmed successful root access on an Alpine Linux honeypot.  The issue affects Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. Alpine Linux’s default OpenSSH server configuration is among the affected setups. An attacker can send an oversized password—between 257 and 1,024 bytes—to trigger the bug and gain access to accounts configured with an asterisk (*) as their password hash. This means attackers do not need to steal SSH keys or valid credentials to obtain access.  SSHole stems from password-handling behavior linked to a 2016 patch for CVE-2016-6210, a username-enumeration flaw. Under the specific conditions, OpenSSH mistakenly treats a failed password-hashing operation as successful authentication because it produces the same asterisk value used to mark password-disabled accounts. The SSH daemon then compares that value with the account’s stored password field and allows the login. Importantly, the flaw does not bypass passwords on accounts that have valid password hashes.  The consequences depend heavily on the privileges of the compromised account. A successful attack grants the attacker the permissions already held by that account, which could include access to deployment credentials, application secrets, and connected infrastructure. From there, intruders may move laterally across systems or disrupt services. The vulnerability does not affect Dropbear, glibc-based Linux distributions, non-Linux systems, or systems that authenticate passwords through PAM. Administrators should act quickly by installing OpenSSH 10.6p2 or their distribution’s patched package and restarting the sshd service. Alpine also advises reviewing /var/log/messages for “Accepted password for” entries involving accounts that should not accept password logins, including root, Alpine, or key-only users. Administrators should inspect recent users, files, authorized keys, and doas usage; if a suspicious login cannot be ruled out, the system should be treated as compromised.

Die Entwickler des Smartphone-Linuxsystems PostmarketOS haben Version 24.06 herausgegeben. Sie unterstützt nun 50 Geräte.

Rootkit malware exploits multiple zero-day vulnerabilities in enterprise appliances by executing a shell script (Install.sh).

Follow us on Twitter (X) @Hackread - Facebook @ /Hackread

A severe remote code execution (RCE) vulnerability has been uncovered by Simone Margaritelli in the Common Unix Printing System (CUPS), affecting all GNU/Linux systems.

Elastic Security's Ruben Groenewoud has released an in-depth exploration of advanced persistence mechanisms used by threat actors on Linux systems.

Linux users beware! OpenSSH, a networking utility installed on every Unix and Linux system by default, is affected by a critical signal handler race condition vulnerability. CVE-2024-6387 (with an impressive CVSS score of 8.1) is a security regressio

Threat actors exploit Linux systems since such systems are prevalent in organizations where they host servers, databases, and other important

Memory corruption lets attackers hijack control flow, execute code, elevate privileges, leak data. ARM's Memory Tagging Extension (MTE) aim

Noodle RAT, a cross-platform backdoor used by Chinese hackers for espionage and cybercrime, targets Windows and Linux systems since 2016.

Die Entwickler des Smartphone-Linuxsystems PostmarketOS haben Version 24.06 herausgegeben. Sie unterstützt nun 50 Geräte.

Die Entwickler des Smartphone-Linuxsystems PostmarketOS haben Version 24.06 herausgegeben. Sie unterstützt nun 50 Geräte.

bitcoin mining read more about SSHStalker Botnet Uses IRC C2 to Control Linux Systems via Legacy Kernel Exploits

government agencies read more about Hackers Exploit SAP Vulnerability to Breach Linux Systems and Deploy Auto-Color Malware

As I was switching to Linux, so did my code base. I admit, most of code didn’t really care on which platform it was running but I wasn’t so fortunate with all of it. One annoying issue was clipboard h...