This media is not supported in your browser
VIEW IN TELEGRAM
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
😱1
On affected Alpine Linux servers, SSH rejects a wrong password but can accept ANY password between 257 and 1,024 bytes for an account with no password set.
One long string is enough. No brute force needed.
Not every Alpine Linux server is vulnerable.
The bypass requires:
• SSH password logins enabled
• Password checks without PAM
• An account with no password set
• Another account with a compatible password hash
Key-only accounts can be exposed too.
It gets worse on certain Alpine cloud images.
The alpine user has passwordless doas access. If the SSH bypass conditions are met, an attacker can log in as alpine and become root.
OpenSSH and Alpine have released fixes.
Can't update yet? Set PasswordAuthentication no and restart sshd.
One long string is enough. No brute force needed.
Not every Alpine Linux server is vulnerable.
The bypass requires:
• SSH password logins enabled
• Password checks without PAM
• An account with no password set
• Another account with a compatible password hash
Key-only accounts can be exposed too.
It gets worse on certain Alpine cloud images.
The alpine user has passwordless doas access. If the SSH bypass conditions are met, an attacker can log in as alpine and become root.
OpenSSH and Alpine have released fixes.
Can't update yet? Set PasswordAuthentication no and restart sshd.
👏5
Upcoming Event: Mimic CTF by Rare Byte Hub
Join us this weekend for a 24-hour online Jeopardy-style CTF! Open to everyone, from newcomers to experienced players looking for a solid challenge. Play solo or team up with friends.
• Start: Sat, 7 Nov 2026, 12:00 UTC (5:30 PM IST)
• End: Sun, 8 Nov 2026, 12:00 UTC (5:30 PM IST)
• Teams: 1 to 4 players
• Level: All skill levels welcome
Register here: https://ctf.rarebytehub.com/events/mimic
CTFtime: https://ctftime.org/event/3455
Share this with anyone who might be interested. See you there!
Join us this weekend for a 24-hour online Jeopardy-style CTF! Open to everyone, from newcomers to experienced players looking for a solid challenge. Play solo or team up with friends.
• Start: Sat, 7 Nov 2026, 12:00 UTC (5:30 PM IST)
• End: Sun, 8 Nov 2026, 12:00 UTC (5:30 PM IST)
• Teams: 1 to 4 players
• Level: All skill levels welcome
Register here: https://ctf.rarebytehub.com/events/mimic
CTFtime: https://ctftime.org/event/3455
Share this with anyone who might be interested. See you there!
❤5
🚀http://github.com/hakluke/hakrevdns
Please open Telegram to view this post
VIEW IN TELEGRAM
🔥4
confirmed 0-day 🚨 2B+ devices affected, no patch, actively exploited daily
1. open a terminal
2. congrats you got a shell
we are so cooked 💀 every computer ever made has an unpatchable 55-year-old RCE. the exploit is literally opening the terminal.
https://terminal2shell.com/
1. open a terminal
2. congrats you got a shell
we are so cooked 💀 every computer ever made has an unpatchable 55-year-old RCE. the exploit is literally opening the terminal.
https://terminal2shell.com/
Terminal2Shell
Terminal2Shell: Critical flaw grants instant shell access on every major OS
Researchers disclose a 55-year-old vulnerability affecting macOS, Windows and Linux. Exploitation is trivial and requires no special tools. No patch exists.
😁6😨2🥰1🤯1