Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2026/11/new-openssh-vulnerability.html

It’s a bad one, and it’s been in the code for a decade:

A newly disclosed flaw involving OpenSSH and musl, dubbed “*sshole,” allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password.

“Oversized” means longer than 256 bytes. Details.

Slashdot thread. And another news article.