Posted by Loganaden Velvindron on Nov 05 It's unfortunate that some people are writing misleading statements about a security problem in OpenSSH, especially on linkedin, despite djm@ explaining that this is a WORKAROUND.
Re: "sshole": password authentication bypass: OpenSSH + musl libc
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/528
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Announce: Portable OpenSSH 10.6p2 released
Posted by Damien Miller on Nov 05 Portable OpenSSH 10.6p2 has just been released. It will be available from the mirrors listed at https://www.openssh.com/ shortly…
CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Posted by Robert Rothenberg on Nov 03 CVE-2026-74846 CPAN Security Group CVE ID: CVE-2026-74846 Distribution: Catalyst-Plugin-Authentication Versions: before 0.10029…
Claude Code extension poisoned with persistent SSH backdoor
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm…
CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
Posted by Hussein Awala on Oct 26 Severity: low Affected versions: - Apache Airflow SSH provider 4.3.0 before 7.0.1 Description: In apache-airflow-providers-ssh before…
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher…
CVE-2026-94135: Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
Posted by Jarek Potiuk on Oct 15 Severity: moderate Affected versions: - Apache Airflow SFTP provider before 7.0.0 Description: The Apache Airflow SFTP provider's…