Özgün Kültekin

Security researcher at Wakefield who discovered and reported the flaw

Appears in 1 story

Last updated Nov 6, 2026

Stories

SSH password bypass exposes musl-based Linux systems

Force in Play

Disclosed the vulnerability on November 5, 2026

Any password longer than 256 characters will log an attacker into an account set up for SSH-key login only, on Alpine Linux and other systems that pair the musl C library with OpenSSH. The flaw, nicknamed *sshole, has worked that way since 2016.

Updated 2 hours ago