Critical security vulnerability affects OpenSSH on Alpine Linux systems

OpenSSH 10.6p2 ships a workaround for a critical vulnerability on Linux systems that use musl libc with PAM disabled, such as Alpine Linux. OpenSSH developer Damien Miller urged affected users to immediately set PasswordAuthentication=no or disable SSH entirely. The bug does not affect non-Linux systems, Linux/glibc systems, or Linux systems using PAM for password authentication. Miller says the root cause lies outside OpenSSH itself, but a mitigation could still be shipped quickly. Alpine Linux will backport the fix all the way back to Alpine 3.16, released in May 2022.

Nguồn: https://lwn.net/Articles/1105464. 8 Sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

Hackaday1 Hot10 phút1 giờ trước

DeviceTree For Hackers: Intro

A leaked Raspberry Pi DeviceTree file reveals hardware details of the Pi Zero 3W, including a BCM2711 chip, PCIe support, a power button, an extra LED, and an eMMC option. This serves as the entry point for an intro to DeviceTree, the format that tells Linux kernels what CPU, drivers, and interfaces a board has. DeviceTree source files (.dts, .dtsi) compile into binary .dtb/.dtbo files the kernel reads, and the device-tree-compiler package handles both compiling and decompiling. The guide covers includes, base files, and overlays, recommends learning from Raspberry Pi's overlay directory and repos like Radxa and Armbian, and warns that LLMs sometimes hallucinate overlay properties.

#linux#embedded#raspberry-piNguồn

Bootlin1 Hot6 phút7 giờ trước

sbom-cve-check 1.4.0 released

sbom-cve-check 1.4.0 has been released, adding an OpenVEX exporter and improving Linux kernel CVE analysis and version parsing. The new openvex export type, contributed by Andrey Zhizhikin, generates OpenVEX v0.2.0 documents with VEX assessments, configurable via a new --export-author option. Kernel CVE handling now distinguishes mainline versions like 6.12 from stable versions like 6.12.34 to reduce false positives and negatives. Version parsing also gained support for formats like 0.9~rc5 and Ubuntu-style suffixes, and build metadata like 1.25.0+4f85853f64 is now ignored per semver rules. Install or upgrade with pip install --upgrade "sbom-cve-check[extra]".

#security#linux#sbomNguồn

Hacker News31 Hot1 phút1 ngày trước

Dux: Free, open-source Wayland desktop shell with file manager and theming

A modern Linux desktop suite with beautiful widgets and powerful monitoring - optimized for niri, Hyprland, mangowm, Sway, and Miracle WM.

#linux#monitoring#window-managerNguồn

Latest Hacking News1 Hot7 phút6 giờ trước

Red Flags to Watch for When Choosing Between AI Pentesting Vendors

Choosing between AI pentesting vendors requires looking past marketing labels like 'autonomous' or 'agentic' because the underlying systems vary widely. A Stanford-led study ran different AI agent frameworks against a live 8,000-host network and found that between 55% and 82% of reported findings were confirmed as real vulnerabilities. Swapping only the underlying model moved one framework's valid finding rate from 57% to 80%, yet that same framework still scored lowest overall since its findings stayed shallow. On a CTF-style benchmark two frameworks scored near-identically (48.6% vs 45.9%), but on the live network one scored nearly three times higher on severity and complexity. Buyers should demand proof of exploitation, real-network results, clear safety controls, data handling answers and clarity on what 'continuous' actually means.

#security#ai-agent#llmNguồn

XDA Developers2 Hot4 phút15 giờ trước

Distro choice doesn’t matter anymore, and that’s why 2027 is the year Linux finally goes mainstream

Picking your distro used to be the hard part, but it doesn't matter nearly as much as it once did

#linux#windows#steamosNguồn

BleepingComputer0 Hot5 phút18 giờ trước

N-able takes cloud platform offline after 30+ "zero-days" published

N-able has taken its hosted N-central environments offline and urged on-premises customers to shut down their servers after a security researcher publicly disclosed more than 30 alleged zero-day vulnerabilities, including exploits that could let attackers take over vulnerable systems.

#security#zero-dayNguồn

freeCodeCamp259 Hot2 phút11 ngày trước

Learn Real-World Penetration Testing: Hands-On Ethical Hacking Crash Course

Understanding how malicious actors infiltrate networks is the first step to building resilient infrastructure. To help developers and aspiring security analysts learn the fundamentals of offensive sec

#security#cyber#linuxNguồn

Hacker News54 Hot4 phút4 ngày trướcTop

Pwn.college

pwn.college is a free, hands-on education platform for learning core cybersecurity and hacking skills, maintained by a team at Arizona State University. Learners progress through belt ranks, starting with a 'white belt' and earning belts through practice. Hackers continue beyond the platform to 'brown belt' and eventually 'black belt' status, which must happen outside the dojo. The site powers much of ASU's cybersecurity curriculum and asks users not to post writeups or walkthrough videos of challenge solutions. It points learners toward CTFtime.org for Capture The Flag events and a GitHub list of wargames for further practice. The underlying infrastructure is open source and accepts pull requests, though some modules remain closed-source.

#security#cyberNguồn