Security researchers have published a reproduction of a critical authentication vulnerability, known as “*sshole,” which could allow unauthorized access to Linux servers running the musl C library. The flaw affects systems such as OpenWrt and the widely used Alpine Linux container distribution, allowing attackers to bypass logins using any password between 257 and 1,024 bytes. On certain AWS and Azure cloud images, the vulnerability is more severe because the default “alpine” user has passwordless administrative access, which can allow an attacker to gain root privileges.
The OpenSSH team has released version 10.6p2 to mitigate the bug, which targets systems where password authentication is enabled but the Pluggable Authentication Module (PAM) is disabled. Damien Miller of OpenSSH advised administrators to update immediately or disable password logins, stating that AI agents now frequently rediscover bugs within hours, rendering traditional long security embargoes ineffective. For servers that cannot be patched immediately, administrators are urged to set “PasswordAuthentication no” and restart the SSH daemon.