[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-openssh-patches-root-login-bypass-on-musl-linux-systems":10,"sections":38},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":37,"feedback_at":22,"cost_usd":37,"total_tokens":37},12496,"openssh-patches-root-login-bypass-on-musl-linux-systems","OpenSSH Patches Root Login Bypass on musl Linux Systems","A long password can get an attacker root on musl-based Linux systems running sshd without PAM, and OpenSSH has shipped a workaround.","If you run SSH on Alpine Linux, OpenWrt, Buildroot or Yocto with password logins enabled, check your setup and update OpenSSH. A bug lets an attacker log in as root by entering a password between 257 and 1,024 characters long.\n\nOpenSSH's release notes call it a critical security workaround for Linux systems that use the musl C library with PAM support disabled. (A C library is the low-level code programs lean on for basic functions. musl is a lightweight alternative to the standard glibc. PAM, the Pluggable Authentication Module, is a framework for handling logins.) Ozgun Kultekin, who found the bug, documented it on sshhole.com.\n\nThe cause is two pieces of code that never meant to meet. One function uses * as a placeholder, assuming it could never be a real password hash. A separate function swaps in a * as the hash when a password is invalid for being too long. Together, an over-long password matches the placeholder and the check passes.\n\nExposure takes several conditions at once, according to the researcher: sshd on musl, PAM off, password logins on (the default), and an account whose password field is just *. He lists key-only users, LDAP users and root on Alpine as accounts that can fit. Alpine's OpenSSH server leaves PAM off by default. Debian, Ubuntu, Fedora, Dropbear and OpenBSD are not affected, he wrote.\n\nOpenSSH said it considers the root cause to be outside sshd, yet patched around it anyway. That is the sensible call: the flaw lives in how two layers interpret each other's output, and sshd is the place where it turns into a remote login.\n\nThe affected group is small, but it skews toward minimal systems that people pick partly for their security reputation. The open question is whether other software that trusts a * in a password field is making the same assumption.","[\"openssh\",\"linux\",\"alpine-linux\",\"vulnerability\"]","2026-11-06T17:31:29.000Z","2026-11-08T05:16:32.864Z","2026-11-08T05:16:35.255Z","published",null,[],"security",[26,27,28,29],"openssh","linux","alpine-linux","vulnerability",[31,34],{"name":32,"url":33},"PCGamer","https:\u002F\u002Fwww.pcgamer.com\u002Fsoftware\u002Flinux\u002Fall-that-stands-between-a-hacker-and-admin-privileges-on-some-linux-distros-is-a-257-character-long-string-of-literally-anything\u002F",{"name":35,"url":36},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcyber-security\u002Fcombined-flaws-let-anyone-into-alpine-linux-and-other-distros-by-typing-anything-over-256-characters-as-a-password-emergency-fixes-for-openssh-and-musl-libc-issued-for-millions-of-systems-patch-immediately",0,{"sections":39},[40,45,49,54,59,64,69,74,79,84,89,94,99,104],{"name":41,"slug":42,"count":43,"latest_published_at":44},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":46,"slug":24,"count":47,"latest_published_at":48},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":50,"slug":51,"count":52,"latest_published_at":53},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":55,"slug":56,"count":57,"latest_published_at":58},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":60,"slug":61,"count":62,"latest_published_at":63},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":65,"slug":66,"count":67,"latest_published_at":68},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":70,"slug":71,"count":72,"latest_published_at":73},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":75,"slug":76,"count":77,"latest_published_at":78},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":80,"slug":81,"count":82,"latest_published_at":83},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":85,"slug":86,"count":87,"latest_published_at":88},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":90,"slug":91,"count":92,"latest_published_at":93},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":95,"slug":96,"count":97,"latest_published_at":98},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":100,"slug":101,"count":102,"latest_published_at":103},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":105,"slug":106,"count":107,"latest_published_at":108},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]