Some OpenSSH instances take any password longer than 256 characters

There can't be any edition without a dumb bug, and today's selection is a vulnerability codenamed SSHhole , discovered by Wakefield security researcher Ozgun Kultekin.

This particular beauty impacts the OpenSSH project and allows attackers to log into accounts with any random string with more than 256 characters. It doesn't matter what the characters are, you get root as long as you type more than 256.

The bug will work against accounts that have the password disabled or use cryptographic keys to log in.

The only positive thing SSHhole is that the bug is not universal and only impacts OpenSSH on Linux distros that use musl as the standard C library.

This includes Alpine Linux, OpenWRT, BuildRoot, and Yocto.

Those sound like no-name projects, but the exposure is absolutely off the charts. Alpine Linux is one of the go-to projects for cloud environments and OpenWRT is an open-source SOHO router firmware that's been adopted by both hobbyists and major router makers alike.

SSHhole impacts all the OpenSSH musl versions released over the past decade. The project released patches on Thursday, a day after it learned of the issue, highlighting just how bad this is.

Alpine Linux has also released security updates , but the rest of the ecosystem is what worries me, since we all know it will take another decade before patches are installed in the wild for some of the routers and IoT gear.

Either way, the bug is very bad, and some serious pwnage is to happen in the coming weeks!

sshhole.com If you use musl, drop everything and patch immediately. This is actually bad. [image or embed] — Xe ( @xeiaso.net ) November 5, 2026 at 2:45 PM

sshhole.com If you use musl, drop everything and patch immediately. This is actually bad. [image or embed]

Who needs AI when you can just mash the keyboard? sshhole.com [image or embed] — Jason Kikta ( @kikta.net ) November 5, 2026 at 5:04 PM

Who needs AI when you can just mash the keyboard? sshhole.com [image or embed]

What do you *mean*, a password > 256 chars can just login to openssh??? sshhole.com [image or embed] — Helix (noop_noob) ( @helix65535.bsky.social ) November 5, 2026 at 3:23 PM

What do you *mean*, a password > 256 chars can just login to openssh??? sshhole.com [image or embed]

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, James and special guest Ciaran Martin at the helm!

Breaches, hacks, and security incidents

Cyberattack targets French blood banks: Hackers sought to raise the temperature of blood bank refrigerators across France this week. The hack failed after staff noticed the sudden temperature rise and intervened to restore normal levels. The French Blood Establishment agency says no plasma bags were compromised in the attack. [ Le Monde ]

An act of war, plain and simple. Europe keeps underestimating hybrid warfare. French nuclear deterrence is the Maginot Line of the 21st century: adversaries will manipulate, hack, and erode our societies until we collapse from within. No serious retaliation in sight. — x0rz (@x0rz) November 4, 2026

An act of war, plain and simple. Europe keeps underestimating hybrid warfare. French nuclear deterrence is the Maginot Line of the 21st century: adversaries will manipulate, hack, and erode our societies until we collapse from within. No serious retaliation in sight.

Kremlin hacktivists claim fridge hacks: Two pro-Kremlin faketivist groups, NoName057(16) and Z-Pentest, have taken credit for the hacks of fridges and refrigerators across Europe, although very few experts seem to believe them. [ Packets from Cyberia ]

DigiCert breach: Certificate authority DigiCert exposed customer data by mistake during a server migration. The data primarily exposed old customer details. DigiCert says the data was accessible for less than a week. [ Mozilla bug tracker ]

One Midterms hack attempt: Just one state election office reported attempts to hack one of its websites on Tuesday, during the US Midterms elections. [ NextGov ]

Breach impacts Iceland schools: A student has hacked Inna, a student-information system used by some Icelandic schools. According to local media, the student exploited a login vulnerability and attempted to alter grades and attendance data. The system is used by at least 16 upper-secondary schools across Iceland. Authorities are investigating if records were altered at more than one school. [ Visir // Iceland Review ]

White House staffers infected with malware: Several staffers inside the White House are using devices running residential proxy apps. These are apps that rent the device's bandwidth to other users across the globe. At least one of the residential proxy apps is owned by a company that previously hosted malicious infrastructure. [ KrebsOnSecurity // Layer3 Intel ]

Japan's Ministry of Foreign Affairs gets hacked: Hackers have breached the internal network of Japan's Ministry of Foreign Affairs. The intruders stole data on 3,600 employees, including names and email addresses. The hack took place at the end of July. The Ministry says the secure part of its internal network was not impacted. [ Nikkei ]

Norway's aid agency hacked: Hackers have breached Norway's international aid agency and stolen the personal data of more than 20,000 grant applicants. Norad says the hackers breached its network via 27 compromised accounts. The agency is now working with the National Security Authority to investigate the intrusion. Norad works under the Ministry of Foreign Affairs and dispenses international aid to foreign organizations promoting human rights, climate protection, and sustainable development. [ Norad ]

Sega suspends arcade game network after hack: Japanese gaming company Sega has temporarily suspended its arcade game network after a cyberattack this week. The hack impacted the Sega ALL.Net and Aime networks. The company is investigating if any user data was also stolen. [ Sega ]

Ahold Delhaize expects €250m hit: Supermarket chain Ahold Delhaize expects to lose up to €250 million in sales due to a cyberattack that defrosted its fridges last month. This is on top of the millions of € in spoiled products following the attacks. Hackers hit Ahold supermarkets in Belgium, Luxembourg, the Netherlands, and Romania. [ Ahold Delhaize ]

Chainstack breach: Hackers have breached blockchain hosting platform Chainstack and stole customer data. The incident took place at the end of last month. Chainstack says the attacker used AI tools to speed up and automate the intrusion. [ Chainstack ]

WorkOS breach: Cloud platform WorkOS says hackers accessed an internal tool used by its sales team but says minimal data was accessed. [ WorkOS ]

Kyiv Independent cyberattack: Russian hackers have breached the Kyiv Independent, one of Ukraine's largest news agencies. The hackers breached its CMS and sent out a with fake news related to the war. Some messages claimed that Ukrainian President Volodymyr Zelensky had been shot and another claimed that Zelensky himself launched a nuke on Kyiv as a sign of peace with Russia. [ The Kyiv Independent // Synaptic Systems ]

NIKKE launcher compromised to deploy malware: Hackers have compromised the PC game launcher for the Goddess of Victory: Nikke RPG video game. The launcher was modified to deploy a remote control agent since at least September 27. It's unclear how the attacker used the access they had, but data theft is likely. The game is available only through the dedicated launcher. [ MotherSphere // PCMag // NIKKE ]

Domain takeover hits Name.com: A threat actor has redirected 15 cryptocurrency-related domains to phishing sites that drained customer wallets. The incident was traced back to a hacked customer support account at domain registrar Name.com. The domain hijacks took place on October 31. Some of the affected crypto platforms include Flap, Kintsu, Pickle Finance, and Origami Finance. [ Name.com // The Block ]

French bank hacked for $133 million: Hackers have stolen $133 million from French banking group Crédit Mutuel Arkéa. A blockchain security named ZachXBT discovered the theft this week when the funds were being laundered on the blockchain. The company applied for a cryptocurrency license in May and was slowly gathering a reserve. [ Decrypt // L'Agefi ]

General tech and privacy

Windows 11 optimizations: Microsoft has shipped a Windows 11 update to improve and speed up the OS on low-resource laptops, such as those with just 8GB of RAM. [ Windows ]

Tencent launches Hy4: Chinese tech giant Tencent has launched Hy4, a new open-source LLM with a focus on cybersecurity and biological safety. [ Tencent ]

OpenAI launches GPT‑6 Cyber: American AI company OpenAI has launched a new cybersecurity model named GPT-6 Cyber. The company says the model has already discovered and helped patch thousands of vulnerabilities. This includes more than 900 Linux privilege escalation bugs and over 80 Firefox vulnerabilities. [ OpenAI ]

Goldman Sachs restricts AI to engineers only: American bank Goldman Sachs has restricted the use of AI tools only for the company's IT and engineering staff. [ Bloomberg Law ]

Google to block at schools that block Gemini: For the past two days, Google has been getting non-stop hate from almost everyone with a pulse after the company said it would block access to its engine at schools that disable its Gemini AI features. The company claims that its engine and AI tools are now practically the same product, which should be enough of a kick for users to move on from that garbage engine. [ Google ]

NYT sues Brave: The New York Times has sued browser maker Brave for shipping a paywall blocker feature that lets users access its monetized content. The NYT is seeking an injunction and damages. The New York Daily News, Chicago Tribune, and Orlando Sentinel also filed their own lawsuits. [ ArsTechnica // The Wrap ]

Chrome 157: Google has released version 157 of its Chrome browser. See here for security patches and webdev-related changes . The biggest change in this release is a new design for Chrome's three-dot . There's also a new security feature to prevent extensions from overriding the settings for the default engine or the new tab page.

Government, politics, and policy

Thai opposition targeted with spyware: Apple has notified two Thai opposition figures that their devices were targeted with mercenary spyware. The People's Party leader Natthaphong Ruengpanyawut and the Democrat Party leader Abhisit Vejjajiv disclosed the attacks in a press conference this week. The two demanded the government clarify if it was involved. The Thai government is a known NSO Group customer. [ The Bangkok Post ]

EU to use AI to write laws: The European Commission is now using AI tools to write laws, because why would actual lawmakers write them. They're elected there just to be pretty. [ Politico Europe ]

In this Risky Business sponsor interview , Catalin Cimpanu talks with Luke Wescott, Threat Detection Engineer at Sublime Security. Luke goes over the recent rise of calendar-based phishing campaigns over the past year and the reasons behind it.

Arrests, cybercrime, and threat intel

SBU dismisses two officials linked to scam call centers: Ukraine's intelligence service has dismissed two high-ranking officials in an anti-corruption probe. The two allegedly took bribes to not investigate local scam call centers. The arrests are part of a broader crackdown against local scam centers that led to the firing of its Prosecutor General in September. [ The Kyiv Independent // SBU // Risky Bulletin ]

Canadian duo hacked supercomputer: The US has charged two Canadian men with hacking US universities and educational institutions to deploy cryptocurrency miners. The hacking campaign took place between 2016 and 2019 and even breached a US supercomputer. The breach allegedly caused damages of $337,000. One of the two suspects was extradited and arraigned in a New York court this week. [ DOJ // CBC ]

T3 quietly dissolved: Cryptocurrency companies have quietly abandoned an industry group set up to fight crypto criminal groups. The T3 Financial Crime Unit was established in 2024 and included backing from Binance, Tron, Tether, and TRM Labs. According to Bloomberg, the group helped freeze more than $250 million stolen assets last year but the group ceased all activity in August with no explanation. [ Bloomberg ]

KeyHunter operation: SOCRadar is tracking a threat actor involved in looting AI-related API keys from cloud services, and also looting data from university networks. [ SOCRadar ]

FBI fridge advisory: The FBI has sent out a security advisory warning American companies to secure their industrial refrigeration systems, in light of the supermarket fridge hacks hitting Europe over the past weeks. [ FBI, PDF ]

Malicious GitHub repos target infosec pros: Russian security firm Dr.Web has spotted another batch of malicious GitHub projects that tried to infect cybersecurity professionals with malware. [ Dr.Web ]

Pestilent Ladybug: Threat intel firm Prodaft has published a profile on Pestilent Ladybug, a threat actor behind mass phishing campaigns targeting Southeast Asia, mainly with tax-related lures. [ Prodaft ]

Malware technical reports

Mirax Android RAT: Group-IB researchers have found a new Android remote access trojan named Mirax that is currently being distributed via fake streaming apps. [ Group-IB ]

Linux DDoS botnet: Threat intel firm Prodaft has found a new Linux DDoS botnet being assembled in the wild after its operators left its files in an open directory. [ Prodaft ]

CWPdoor: Chinese security firm QiAnXin discovered a passive backdoor designed to run inside Control Web Panel, a free, open-source server management control panel for CentOS and other Linux distributions. [ QiAnXin ]

Lindnor backdoor: Symantec and Carbon Black researchers look at Lindnor, a backdoor typically used in attacks with the Anubis ransomware. [ Broadcom ]

HYFLOCK ransomware encryption weakness: Check Point suggested it found a weakness in the encryption scheme used by HYFLOCK, a ransomware operation that launched in August. [ Check Point ]

Qilin ransomware: Seqrite researchers look at the code changes in the Qilin ransomware this year. The group was this year's most active gang, with almost half of its victims in the US alone. [ Seqrite ]

OverLord Stealer: A forged commit in the antd-img-crop GitHub repository deployed the OverLord Stealer in GitHub releases. The npm portal version was not affected. [ SafeDep ]

Phexia: Security firm WithSecure has published a technical breakdown of Phexia, a macOS backdoor and infostealer deployed through ClickFix campaigns. [ WithSecure ]

PhantomDOM: ZeroBEC has discovered a new BitM phishing kit named PhantomDOM that uses a custom DOM-mirroring technique built to hijack Microsoft 365 sessions. [ ZeroBEC ]

ARTEX: Security researchers have published a breakdown of ARTEX, the AI pentesting framework that's been abused in a bunch of APT hacking campaigns over the past few months. [ Check Point // Huntback ]

BOSSAI: A suspected Chinese threat actor is using a mesh of AI agents named BOSSAI to coordinate attacks across 12 countries. Confirmed victims include universities and emergency services providers in Taiwan. Security firm Acronis says the threat actor had to use locally run abliterated models for the attacks after commercial models and Chinese open-source models refused hacking instructions. [ Acronis ]

In this product demo Sublime Security co-founder and CEO Josh Kamdjou joins Risky Business podcast host Patrick Gray to show off the company's email security platform, including its latest agentic AI bells and whistles.

APTs, cyber-espionage, and info-ops

PolinRider hits npm again: North Korean group PolinRider is back on npm with new malicious packages. Don't worry! These ones will be used to hack Coinbase, not Binance! [ Ox Security ]

SlippyNunchucks: A Chinese cyber espionage group has carried out a DNS hijack against the Sogou Input Method software to deliver malicious updates to Chinese speakers abroad. The malicious update installed the DarkVigil backdoor on specific systems. ESET says the hackers behind this operation have been active since last year. The company tracks them as SlippyNunchucks. [ ESET ]

APT29 watering hole attack: Russian espionage group APT29 is conducting a large-scale watering hole attack against Android and iOS smartphones. The group is using hacked websites to run malicious scripts on the devices and then steal cookies, WiFi passwords, and other device data. Most of the attacks targeted Ukraine and used old exploits. [ Sekoia ]

Vulnerabilities, security research, and bug bounty

Security updates: Apache OFBiz , Chrome , Cisco , Debian , Gitea , Kubernetes , OpenSSH , Qualcomm , Ruby on Rails , Samsung , Ubuntu , WatchGuard , Zyxel .

WP bug under attack: Threat actors are exploiting a recently patched race condition vulnerability in the highly popular WordPress CMS. According to Picus Security, the bug can allow an attacker to replace a website's configuration file during the update process. The bug was patched last week. CISA added it to the KEV database this week. [ Picus Security // CISA ]

Zyxel patches zero-day: Zyxel has released security updates this week to patch an actively exploited zero-days in GS1900 switch series. The vulnerability has been exploited since June. Attackers used it to deploy the JITTERLY backdoor and SIXZUT rootkit on almost 1,000 devices. According to security firm Binarly, an initial patch did not address the zero-day, which continued to work. The zero-day was part of a larger campaign linked to the Red Heron group that targeted multiple other web technologies for data theft. [ Binarly // Zyxel CVE-2026-107441 ]

SonicWall won't fix GMS flaws: SonicWall will not release fixes for two vulnerabilities in the Global Management System (GMS) global firewall management platform. The two bugs allow attackers to read files and execute SQL injection attacks. SonicWall retired the platform in June 2025. [ SonicWall PSIRT // EOL announcement ]

Docker Sandboxes bug: Researchers have found a vulnerability in Docker Sandboxes that can let AI agents escape boundaries and access other data. [ Endor Labs ]

APT enables root access: Step Security has a write-up on an APT installer bug that can let MitM attackers gain root access on Debian and Ubuntu systems. [ Step Security ]

GhostMap technique puts Android devices in a crash loop: Bitdefender researchers have found a technique for crafting Android app installation packages that can put the device in a crash loop. The root cause resides in how Android parses the data stored inside an app's ZIP installation package. The malformed data can make the Android OS map the app to a memory space it didn't allocate and trigger an infinite crash loop. The crash loop also triggers after a phone restart, and even when the device is put in Safe Mode. [ Bitdefender ]

AppTrickster technique: RT-Solar, Rostelecom's security team, has discovered a new technique, named AppTrickster, that abuses AppLocker to prevent the launch of EDR and other security tools. [ Rostelecom ]

Threat/trend reports: BlackFog , CyFirma , Halcyon , IBM , Lab 1 , Microsoft , Positive Technologies , ReliaQuest , and Trellix have recently published reports and summaries covering various emerging threats and industry trends.

NASA contractors fined: The US Department of Justice has fined two defense companies $13 million for lying their cybersecurity posture to obtain government contracts. ILC Dover and ILC Astrospace stored controlled unclassified information at a cloud provider without FedRAMP accreditations. The two companies also did not implement cybersecurity controls on their networks and failed to patch vulnerabilities. The two had contracts with NASA, the US Army, and the Missile Defense Agency. [ DOJ ]

Google donates two security tools: Google has donated two security tools to the Cloud Native Computing Foundation. The company has donated gVisor, a Linux-compatible sandbox, and Agent Substrate, a platform to run agents at scale in isolated environments. [ Google ]

New tool—OrcDecryptNet: Security firm Intrinsec has released OrcDecryptNet , a .NET port of ANSSI's OrcDecrypt Python tool.

Risky Business podcasts

In this edition of Seriously Risky Business , Tom Uren and Amberleigh Jack talk North Korea's hack of the Binance cryptocurrency exchange. Binance's founder CZ says it is a wake up call for real banks, but he's wrong.