OpenSSH flaw bypasses password-disabled Linux accounts
A newly disclosed OpenSSH flaw can let attackers enter oversized passwords to access some accounts configured to reject password authentication, BleepingComputer and Techmeme reported. The issue, dubbed “*sshole,” affects certain Alpine Linux and other systems using the musl C library. Researchers described it as a decade-old weakness now brought to public attention.
Why it matters
Systems administrators may need to review supposedly password-disabled accounts because the configuration alone may not block this attack path.
Sources
finite. summarises the reporting above and links to each original. We do not reproduce full articles. Read the sources for complete coverage.
Part of the November 6, 2026 brief.