#linux

Özgün Kültekin of the security firm Wakefield published an illustrated write-up (under a pun on "ssh") of a login bypass in OpenSSH on Linux systems built on the musl C library, such as Alpine, OpenWrt, Buildroot and Yocto, when sshd runs without PAM. Locked or key-only accounts are marked with a "" instead of a password hash. Since 2012, musl's crypt() returns "" when it fails, and it fails on passwords over 256 bytes. Because sshd hashes a wrong password even for such accounts, a password of 257 to 1,024 characters produced "*" and matched. He says the flaw has existed since 2016 and that on Alpine's official AWS and Azure images the default user, which has passwordless doas, is affected, which amounts to root.

He says he found it by testing about 17,600 unusual logins across many sshd builds with "agent swarms". OpenSSH 10.6p2, released November 5, works around it in sshd; the OpenSSH team says it considers the root cause outside sshd. The fix is to upgrade or turn off password logins, and his GitHub repo has a check script.

In a November 2 post, the developer behind chalmovsky.com writes that he took all his Ubuntu servers offline and is moving them to another distribution. His complaint: CVE-2026-98432, a critical (CVSS 9.8) remotely reachable use-after-free in the Linux kernel's TCP code, had been patched by Debian on October 16, and Anthropic says it built a working root exploit, yet more than two weeks later every supported Ubuntu release, LTS included, was listed as vulnerable. He contrasts this with Ubuntu's promise of "timely patches for critical vulnerabilities" and with volunteer-run distributions (Debian, Arch, Alpine) that had shipped the fix.

Atlas's advisory, updated November 5, says Red Hat shipped fixed kernels on November 1 and AlmaLinux on November 2, while Ubuntu had a fixed kernel only for 26.10 and its fixes for 22.04, 24.04 and 26.04 were still in testing. Ubuntu's CVE page rates the bug Critical and offers an interim packet-filtering mitigation.

Ghostty, the free, non-profit terminal emulator, released version 1.4.0 on October 27 after seven months of work: 2,889 commits from 172 contributors. Highlights from the release notes:

• Memory: scrollback that isn't on screen is now compressed while the terminal is idle, cutting its physical memory use by 70-90% for typical text, so the default scrollback limit rose from 10 MB to 50 MB. Hidden tabs release GPU memory (about 385 MiB down to 18 MiB in one macOS test).
• Graphics: Ghostty now implements 100% of the Kitty graphics protocol, including animation, which the maintainers say makes it the first terminal other than Kitty to do so.
• Speed: the team found macOS caps each read from a pseudo-terminal at about 1 KiB and reworked how output is drained and parsed.
• Security: ten advisories are fixed, including paste protection that missed carriage returns and crafted Kitty graphics or hyperlinks that could, in some cases, read files or run commands. It also supports macOS 27.

On Hacker News, users compared it with Konsole, WezTerm and iTerm2, and a commenter from the project pointed to libghostty, the embeddable terminal core.