OpenSSH and musl-libc flaws allow logins to Alpine Linux and other distros using any password over 256 characters.
Emergency fixes have been issued for OpenSSH and musl-libc. Combined flaws allow logins to Alpine Linux and other distros with anything over 256 characters entered as a password. An OpenSSH flaw also lets attackers access password-disabled Linux accounts.
—
3 Sources, first seen ago
@BleepinComputerOpenSSH flaw lets attackers log into password-disabled Linux accounts https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/ https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/
@tomshardwareCombined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately
@TheRegisterAn oversized password could get attackers root access on some musl-based Linux systems, thanks to a decade-old OpenSSH authentication flaw. More here:https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910 https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910@BleepinComputerOpenSSH flaw lets attackers log into password-disabled Linux accounts https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/ https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/@tomshardwareCombined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately@TheRegisterAn oversized password could get attackers root access on some musl-based Linux systems, thanks to a decade-old OpenSSH authentication flaw. More here:https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910 https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910@BleepinComputerOpenSSH flaw lets attackers log into password-disabled Linux accounts https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/ https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/@tomshardwareCombined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately@TheRegisterAn oversized password could get attackers root access on some musl-based Linux systems, thanks to a decade-old OpenSSH authentication flaw. More here:https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910 https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910@BleepinComputerOpenSSH flaw lets attackers log into password-disabled Linux accounts https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/ https://www.bleepingcomputer.com/news/security/openssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts/@tomshardwareCombined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately https://www.tomshardware.com/tech-industry/cyber-security/combined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately@TheRegisterAn oversized password could get attackers root access on some musl-based Linux systems, thanks to a decade-old OpenSSH authentication flaw. More here:https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910 https://www.theregister.com/security/2026/11/05/get-root-on-a-musl-linux-system-by-slamming-it-with-an-overly-long-password/5307910#11
#11
