{
  "id": 18405237,
  "title": "Meet *sshole, the vulnerability that lets hackers SSH into Linux devices",
  "url": "https://urgent.news/2026/11/05/meet-sshole-the-vulnerability-that-lets-hackers-ssh-into-linux-devices",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-05T23:09:36.000Z",
  "source": {
    "name": "Ars Technica",
    "slug": "ars-technica",
    "url": "https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/"
  },
  "original_language": "en",
  "account": "Alpine Linux devices, along with potentially other distributions, are susceptible to a ten-year-old vulnerability that allows unauthorized access via SSH without requiring a password. This flaw stems from the interaction between OpenSSH, the code library responsible for SSH connections, and musl, a lightweight alternative to the libc library, which is unique to Alpine Linux. Notably, OpenSSH integrated with musl cannot utilize PAM (pluggable authentication modules), a framework responsible for user authentication and account-access checks.\n\nAlpine, a lightweight and widely adopted Linux distribution, is particularly vulnerable. To exploit this vulnerability, a system must meet two additional criteria. Firstly, it must possess at least one user account that can be accessed using a password hashed using the SHA256 or SHA512 functions. Secondly, the targeted system account must be configured for passwordless access by leaving the password field in the /etc/shadow file empty. This configuration is frequently employed for accounts utilizing certificate-based authentication.\n\nInterestingly, once the conditions are met, the successful exploitation of this vulnerability guarantees access with a single connection, and no retries are necessary.",
  "summary": "Certain configurations of Alpine are affected. Other distros may be as well.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}