SSH
4 articles with this tag
OpenSSH 10.6p2 emergency fix (CVE-2026-123158): password-authentication bypass in sshd on musl systems without PAM, such as Alpine
On November 5, 2026 OpenSSH released 10.6p2 with a critical workaround for a password-authentication bypass in sshd on some Linux systems built and run with PAM disabled, notably those using musl libc. The CVE is CVE-2026-123158 (CVSS 3.1 base score 8.1, assigned by the CVE record's own scoring). Alpine Linux published an advisory the same day with fixed packages for every branch. Per Alpine, a host is affected when password authentication is on, an account has an asterisk in its password field, and another account has a regular hash. Setups with PAM enabled, with PasswordAuthentication no, or containers that do not run sshd are not affected. CISA's KEV did not list it as of November 7. A private threat-intelligence firm has reportedly seen attack attempts less than nine hours after publication, but no independent verification was found. This site's conclusion: check whether sshd runs on musl without PAM, update to 10.6p2 or your distribution's fixed package and restart sshd, turn off password authentication until then, and review authentication logs.
Tampered 'Claude Code' extension on the Cursor marketplace (Oct 29, about 11 hours): how to check for an SSH backdoor
Cursor published a security notice on October 29, 2026 (updated October 30) saying tampered versions 2.1.312 and 2.1.313 of an extension published under Anthropic's name (Anthropic.claude-code) were distributed on the Cursor extension marketplace for Windows and macOS between about 2:27 am and 1:35 pm Pacific Time on October 29. Cursor states the versions were not developed by Anthropic. According to Cursor, the code ran when the extension loaded, collected host and user information, added an attacker-controlled SSH key (labeled svc-telemetry), tried to enable SSH and open a reverse tunnel, installed persistence through a LaunchAgent on macOS or a scheduled task or Startup entry on Windows, and sent host details to the attacker. Cursor says enabling SSH fails on most hosts, so the attacker could not have logged in through the tunnel there. Cursor removed the extension, paused the marketplace, audited other extensions, rotated keys, and says the attacker server no longer functions. Cursor says it has no evidence that other versions or the official distribution are affected. BleepingComputer reports up to about 5,000 developers may have been exposed. Our conclusion: if you installed or updated that extension in Cursor on October 29, check for the key and persistence entries, and rotate the secrets reachable from that machine.
Security inventory: 7 checks people running several servers overlook
For solo/small operators, incidents come less from missing controls than from untracked state. The boundary is the PC holding your keys. Prioritize 2FA by which account can recover the others (email first), list which SSH key opens which server and delete duplicates, unused keys and leftover registrations, remove plaintext passwords from the cloud, remediate reversibly one at a time, and keep secrets out of the ledger. Inventory before adding tools.
SSH key least privilege: keep production root keys off ephemeral environments that can be compromised
Registering a root key into production from an ephemeral, compromisable environment (GPU pod, CI runner, throwaway VM) means that the moment the environment is compromised, an attacker gets root on production. Fix: no root keys on ephemeral environments; remove keys when unused; if needed again, use a non-root user plus a command-restricted key that limits the key to one operation. Treat a reused key as your most critical asset, and never build a setup where one leaked key opens every server.