Researcher: *sshole, a decade-old OpenSSH flaw, lets attackers use a password of 256+ characters to log into passwordless accounts on some musl Linux systems (Lawrence Abrams/BleepingComputer)
The long-standing vulnerability, dubbed *sshole, targets environments running musl-based distributions where specific accounts have been left without password requirements. Attackers can bypass normal authentication mechanisms by simply entering an input string that reaches 256 or more characters in length. This allows threat actors to gain unauthorized access directly into those unconfigured profiles. The flaw and its mechanism were detailed by Lawrence Abrams in an article for BleepingComputer.
Key points
Systems configured with passwordless accounts are vulnerable to direct unauthorized acces…: Systems configured with passwordless accounts are vulnerable to direct unauthorized access under these conditions.
Standard authentication controls fail on affected musl Linux distributions when oversized…: Standard authentication controls fail on affected musl Linux distributions when oversized passwords are submitted.
Lawrence Abrams documented this decade-old security loophole in technical reporting publi…: Lawrence Abrams documented this decade-old security loophole in technical reporting published by BleepingComputer.
Sources checked by our analysis pipeline: 1
Thinking Machines Lab: |
Wall Street Journal: |
Mackenzie Hawkins / Bloomberg: |
Kevin Breuninger / CNBC: |
Natalia Kniazhevich / Bloomberg: |
Jada Nagumo / Nikkei Asia: |
Reuters: |
Pranshu Verma / Washington Post: |
Kana Inagaki / Financial Times: |
Bloomberg: |
Matthias Bastian / The Decoder: |
Alexander Martin / The Record: |
Reuters: |
Emmy Martin / New York Times: |
New York Times: |
Qianer Liu / The Information: |
Financial Times: |
Tiffany Li / The Information: |
Eric Geller / Cybersecurity Dive: |
Lawrence Abrams / BleepingComputer: |
Radhika Rajkumar / ZDNET: |
Emma Roth / The Verge: |
Davey Alba / Bloomberg: |
This is a Techmeme archive page. It shows how the site appeared at 11:30 AM ET, November 6, 2026.
The most current version of the site as always is available at our home page. To view an earlier snapshot click here and then modify the date indicated.
Cybersecurity analysts discovered that an internal user on the presidential compound's network likely installed software embedding third-party proxy tools, exposing administrative infrastructure to unauthorized traffic. Malicious actors could exploit these cheap commercial channels to mask illicit activity behind prestigious executive addresses to bypass security defenses. This unintended gateway creates significant defensive vulnerabilities for critical government systems against foreign and domestic cyber threat…
The new monthly subscription service called Stack arrives alongside the 6.0 e-reader firmware update, which is currently out as an optional beta. Readers can transfer their own reading materials, progress, and personal notes across apps and hardware via a web interface or dedicated email. This expansion targets readers outside the United States who want seamless multi-device continuity for sideloaded files.
Apple reached this major software milestone just two weeks after launching its new foldable device, driven by thousands of developers adapting their products daily. However, user experiences remain uneven across the platform as popular services struggle with the unique hardware. Developers face ongoing technical hurdles while trying to format their interfaces properly for the new foldable screen.