OpenSSH Emergency Fix Addresses Critical Authentication Bypass Vulnerability on Alpine Linux
Crafted password lengths between 257 and 1,024 bytes can bypass SSH authentication on affected systems
Key Takeaways
- OpenSSH version 10.6p2 released to fix critical authentication bypass flaw.
- Affected systems: Alpine Linux servers running the standard openssh-server package.
- Attack vector: Network access plus account name + password field between 257 and 1,024 bytes.
- Impact: Attackers can log in to accounts without passwords, including SSH key-only accounts.
Related Security News
SonicWall Warns of Unpatched Flaws in End-of-Life GMS Software
SonicWall has alerted customers that two security flaws in the end-of-life Global Management System (GMS) will not receive patches, leaving deployed systems permanently vulnerable. The advisory urges immediate migration to supported platforms.
Critical Vulnerability in APT Package Manager Enables MitM Package Swapping on Debian and Ubuntu Systems
A security vulnerability in the Advanced Package Tool (APT) used by Debian and Ubuntu distributions has been disclosed. The flaw stems from APT's default retry-on-failure behavior, which, when combined with a man-in-the-middle (MitM) position, allows an attacker to intercept and swap package downloads. The substituted package executes with root privileges during installation, bypassing standard verification checks. Advisories were published on November 4, 2026, by Debian, Ubuntu, and the APT Project. Users on Debian 12 and affected Ubuntu versions with default APT configurations are at risk.
