Blog / tag
A newly disclosed OpenSSH flaw, CVE-2026-123158 or 'sshhole', lets attackers log into locked accounts on Alpine Linux and other musl-based systems by typing any password longer than 256 characters. Public exploits are already circulating, and fixes shipped within a day of the report.
.png&w=3840&q=75)
A critical authentication bypass in OpenSSH (CVE-2025-26465) has lurked undetected since 2014, allowing attackers to impersonate any SSH server when a rarely-enabled option is configured. The vulnerability affects all releases from 6.8p1 through 9.9p1.
