Posted by Vincent Lefevre on Nov 05 Perhaps, but in any case, it is up to the application to check error conditions, in particular that the result contains only valid characters.
Re: "sshole": password authentication bypass: OpenSSH + musl libc
About this summary. This is a short excerpt from the description that oss-security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/535
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Re: "sshole": password authentication bypass: OpenSSH + musl libc
Posted by Loganaden Velvindron on Nov 05 It's unfortunate that some people are writing misleading statements about a security problem in OpenSSH, especially on linkedin…
Announce: Portable OpenSSH 10.6p2 released
Posted by Damien Miller on Nov 05 Portable OpenSSH 10.6p2 has just been released. It will be available from the mirrors listed at https://www.openssh.com/ shortly…
CVE-2026-74846: Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier
Posted by Robert Rothenberg on Nov 03 CVE-2026-74846 CPAN Security Group CVE ID: CVE-2026-74846 Distribution: Catalyst-Plugin-Authentication Versions: before 0.10029…
Claude Code extension poisoned with persistent SSH backdoor
A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm…
CVE-2026-111422: Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
Posted by Hussein Awala on Oct 26 Severity: low Affected versions: - Apache Airflow SSH provider 4.3.0 before 7.0.1 Description: In apache-airflow-providers-ssh before…
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher…