[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f3PVU0iQoJ5ioPUCYvM_gjFELd9zYyv-miAWwz3FqfRo":3},{"article":4,"iocs":44,"watch_terms":49,"solutions":50,"lesson":128},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"bfca9591-485c-4957-a574-2d1e5623966b","OpenSSH flaw lets attackers log into password-disabled Linux accounts","openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts-0104ff","A newly disclosed OpenSSH vulnerability dubbed \"*sshole\" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication, simply by entering an oversized password. [...]","A vulnerability dubbed '*sshole' in OpenSSH allows attackers to log into Linux accounts configured to block password authentication by sending an oversized password. This flaw affects musl-based systems like Alpine Linux when PAM is disabled and password authentication is enabled, potentially granting root access via default 'alpine' accounts. The issue, present since 2016, has been fixed in OpenSSH 10.6p2.","OpenSSH vulnerability allows login to password-disabled accounts via oversized passwords.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fopenssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F05\u002Fssh-header-image.jpg","2026-11-05T17:45:29+00:00","2026-11-05T18:00:07.869648+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":22},"musl C library","technology",{"name":24,"type":22},"Linux",{"name":26,"type":19},"Alpine Linux",{"name":28,"type":19},"OpenWrt",{"name":30,"type":19},"Buildroot","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[45],{"type":46,"value":47,"context":48},"cve","CVE-2016-6210","Related vulnerability that changed OpenSSH handling of accounts without usable password hashes.",[18,26,28],{"controls":51,"vendors":127},[52,81,109],{"slug":53,"name":54,"problem":55,"products":56},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":82,"name":83,"problem":84,"products":85},"patch-management","Automated patch management","Known holes get closed in days, not months.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":82,"product_name":106,"url":107,"description":108},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":110,"name":111,"problem":112,"products":113},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[114,119],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":115,"product_name":116,"url":117,"description":118},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[],{"slug":129,"title":130,"body":131,"framework_refs":132,"framework_notes":140},"openssh-sshole-flaw-enables-login-to-password-disabled-linux-accounts","OpenSSH '*sshole' Flaw Enables Login to Password-Disabled Linux Accounts","A vulnerability in OpenSSH, present since 2016, allowed attackers to bypass password-disabled account restrictions on musl-based Linux systems (such as Alpine Linux) by sending an oversized password string when PAM is disabled. This meant accounts explicitly configured to reject password authentication — including default 'alpine' root accounts — could be silently compromised, potentially granting full root access. The flaw highlights how dangerous default credentials and misconfigured authentication stacks can be when combined with an unpatched vulnerability. It matters because Alpine Linux is widely used in containerized and cloud-native environments, dramatically broadening the attack surface. The fix has been available since OpenSSH 10.6p2, making timely patching the most direct mitigation.",[133,134,135,136,137,138,139],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 17: Incident Response Management","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":141,"NIST SP 800-53 SI-2: Flaw Remediation":142,"CIS Control 17: Incident Response Management":143,"OWASP A06:2021 Vulnerable and Outdated Components":144,"CIS Control 7: Continuous Vulnerability Management":145,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":146,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":147},"NIS2 requires entities to implement measures covering incident handling and vulnerability management; the prolonged existence of this flaw without detection or remediation would represent a gap in the technical security measures required under this article.","SI-2 requires organizations to identify, report, and correct information system flaws; applying this control would have mandated timely installation of OpenSSH 10.6p2 once the vulnerability was disclosed.","Given this flaw may have been silently exploited since 2016, a mature incident response capability — including retrospective log analysis — is essential to determine whether unauthorized logins occurred before the patch was applied.","Running an OpenSSH version carrying a known authentication bypass vulnerability is a direct instance of using an outdated component; OWASP A06 guidance calls for inventorying and updating such components continuously.","The OpenSSH flaw existed since 2016 and a patch is now available; a continuous vulnerability scanning and patching program would have identified the outdated OpenSSH version and enforced remediation before attackers could exploit it.","This control requires timely identification and remediation of technical vulnerabilities in deployed software; following it would have flagged the OpenSSH flaw and driven patching across Alpine Linux-based systems.","The vulnerability undermined authentication controls on accounts explicitly configured to deny password logins; PR.AA calls for ensuring authentication mechanisms function as intended and are resilient to bypass."]