A vulnerability in OpenSSH known as '*sshole,' which had been overlooked for ...

However, not all Linux environments are affected. For the attack to succeed, certain conditions must be met, including the use of musl libc, OpenSSH not using an authentication management mechanism called PAM, and SSH password authentication being enabled. In addition to the target account with '*' in the password field, another local account with a valid password hash in SHA-256 or SHA-512 format is required. If these conditions are met, an attacker can log in to the target account simply by knowing the username and entering a password of 257 to 1024 bytes. According to the Alpine Linux development team, the attack will succeed on a single connection, without requiring multiple password attempts. According to the Alpine Linux development team, the attack requires several conditions to be met: OpenSSH password authentication must be enabled, PAM authentication must not be used, and there must be an account with '*' recorded in the password field. Furthermore, if even one other local account with a password hash in SHA-256 or SHA-512 format exists, the attacker can log into an account that is disabled for password authentication by simply sending a password of 257 to 1024 bytes. Only one connection is required for the attack, and there is no need to repeatedly try the password. The most significant impact is on the official Alpine Linux cloud image, 'tiny-cloud.' Some images of Alpine Linux versions 3.18.11 through 3.24.3 include a user named 'alpine' that can gain administrator privileges without a password. While the attack conditions are not met in the initial state, if the administrator sets a password for another user, the conditions are met, allowing an attacker to log in as the alpine user and gain administrator privileges. A website by Kyurtekin et al. features a demo that allows users to compare authentication results when entering the same password on Debian and Alpine Linux. Authentication fails with a normal password or a 256-character password, but when a 300-character password is entered, the Alpine Linux system finds a match between the hash calculation result and the stored '*', resulting in successful authentication. A particular problem lies with the official Alpine Linux cloud images provided for Amazon Web Services (AWS) and Microsoft Azure. Some images include a user named 'alpine' that has password authentication disabled, and this user can gain administrator privileges using a mechanism called 'doas'. Even if the attack conditions are not met in the initial state, there is a risk that administrator privileges could be seized from outside if the administrator sets a password for another user, etc. Note that OpenSSH's default settings prohibit password login to the root account, so this vulnerability alone does not allow direct login to root. Furthermore, the reported issue does not occur in glibc environments commonly used in Debian and Ubuntu, or with PAM-based authentication. According to Kyurtekin, the combination of specifications that causes the vulnerability has existed since 2016. However, the combination of OpenSSH and musl libc is difficult to verify with normal testing, and since the problem is circumvented by authentication using PAM in many Linux environments, it is thought that it went undetected for 10 years. Kyurtekin explains that he discovered the problem by building multiple OpenSSH environments with variations in glibc, musl libc, and the presence or absence of PAM, and trying approximately 17,600 abnormal login attempts. He also mentioned that he used multiple AI agents in this verification process. On November 5, 2026, the OpenSSH development team released 'OpenSSH 10.6p2,' which includes fixes for the vulnerability. Alpine Linux also provides patch packages for each version and urges users to update promptly and restart their SSH servers. If you cannot update immediately, you can prevent attacks by disabling password authentication in the SSH settings by specifying 'PasswordAuthentication no'. The OpenSSH development team explains that the root cause of the vulnerability lies outside of OpenSSH, while the musl libc developers maintain that the problem lies in how the function is being used by the caller. In any case, this is an example of how long-standing authentication processes and library specifications can combine to lead to unintended authentication successes. The Alpine Linux development team issued a security advisory on November 5, 2026, urging users to update OpenSSH and restart their SSH servers. Fixes are available for Alpine Linux versions 3.21 through 3.24, as well as for versions 3.16 through 3.20, which are no longer officially supported. Simply updating the packages will not apply the fixes to running SSH servers; a restart is required. If you cannot update immediately, it is recommended to disable password authentication by specifying 'PasswordAuthentication no' in the SSH settings. Furthermore, Kyurtekin also provides a method for checking whether this vulnerability has been exploited. for the 'Accepted password' entry in '/var/log/messages,' where SSH logs are stored, and check '/etc/shadow,' where password information is stored. If the password field for a user who successfully logged in shows '*', it means that password authentication, which is normally prohibited, was successful, and the vulnerability may have been exploited.

A particular problem lies with the official Alpine Linux cloud images provided for Amazon Web Services (AWS) and Microsoft Azure. Some images include a user named 'alpine' that has password authentication disabled, and this user can gain administrator privileges using a mechanism called 'doas'. Even if the attack conditions are not met in the initial state, there is a risk that administrator privileges could be seized from outside if the administrator sets a password for another user, etc. Note that OpenSSH's default settings prohibit password login to the root account, so this vulnerability alone does not allow direct login to root. Furthermore, the reported issue does not occur in glibc environments commonly used in Debian and Ubuntu, or with PAM-based authentication. According to Kyurtekin, the combination of specifications that causes the vulnerability has existed since 2016. However, the combination of OpenSSH and musl libc is difficult to verify with normal testing, and since the problem is circumvented by authentication using PAM in many Linux environments, it is thought that it went undetected for 10 years. Kyurtekin explains that he discovered the problem by building multiple OpenSSH environments with variations in glibc, musl libc, and the presence or absence of PAM, and trying approximately 17,600 abnormal login attempts. He also mentioned that he used multiple AI agents in this verification process.

On November 5, 2026, the OpenSSH development team released 'OpenSSH 10.6p2,' which includes fixes for the vulnerability. Alpine Linux also provides patch packages for each version and urges users to update promptly and restart their SSH servers. If you cannot update immediately, you can prevent attacks by disabling password authentication in the SSH settings by specifying 'PasswordAuthentication no'. The OpenSSH development team explains that the root cause of the vulnerability lies outside of OpenSSH, while the musl libc developers maintain that the problem lies in how the function is being used by the caller. In any case, this is an example of how long-standing authentication processes and library specifications can combine to lead to unintended authentication successes. The Alpine Linux development team issued a security advisory on November 5, 2026, urging users to update OpenSSH and restart their SSH servers. Fixes are available for Alpine Linux versions 3.21 through 3.24, as well as for versions 3.16 through 3.20, which are no longer officially supported. Simply updating the packages will not apply the fixes to running SSH servers; a restart is required. If you cannot update immediately, it is recommended to disable password authentication by specifying 'PasswordAuthentication no' in the SSH settings. Furthermore, Kyurtekin also provides a method for checking whether this vulnerability has been exploited. for the 'Accepted password' entry in '/var/log/messages,' where SSH logs are stored, and check '/etc/shadow,' where password information is stored. If the password field for a user who successfully logged in shows '*', it means that password authentication, which is normally prohibited, was successful, and the vulnerability may have been exploited.

The OpenSSH development team explains that the root cause of the vulnerability lies outside of OpenSSH, while the musl libc developers maintain that the problem lies in how the function is being used by the caller. In any case, this is an example of how long-standing authentication processes and library specifications can combine to lead to unintended authentication successes. The Alpine Linux development team issued a security advisory on November 5, 2026, urging users to update OpenSSH and restart their SSH servers. Fixes are available for Alpine Linux versions 3.21 through 3.24, as well as for versions 3.16 through 3.20, which are no longer officially supported. Simply updating the packages will not apply the fixes to running SSH servers; a restart is required. If you cannot update immediately, it is recommended to disable password authentication by specifying 'PasswordAuthentication no' in the SSH settings. Furthermore, Kyurtekin also provides a method for checking whether this vulnerability has been exploited. for the 'Accepted password' entry in '/var/log/messages,' where SSH logs are stored, and check '/etc/shadow,' where password information is stored. If the password field for a user who successfully logged in shows '*', it means that password authentication, which is normally prohibited, was successful, and the vulnerability may have been exploited.

It turns out that OpenWrt had a vulnerability that allowed collision attacks to be performed because it only used 12 digits of the SHA-256 hash value

Critical OpenSSH vulnerability 'regreSSHion' (CVE-2024-6387) discovered, affects almost all Linux systems

Windows update makes dual booting with Linux impossible

How to hijack AWS account with 'Log4Shell' is reported

A vulnerability is found in Ubuntu that makes it easy for anyone to create a privileged user

'LastPass' announces that it will force passwords of 12 characters or more, be careful as you may be locked out and stuck

A remote code execution vulnerability has been discovered in NGINX; the affected versions are listed below.

Privilege elevation vulnerability in 'sudo' command, list of correspondence of each distribution

Nov 06, 2026 11:25:00 in Software , Security , Posted by log1i_yk