OpenSSH Flaw in musl-Based Systems Exposes Alpine, OpenWrt and IoT Devices to Credential Theft

·1 views

A memory-handling bug in the musl-specific OpenSSH code path, tracked as CVE-2026-YYYY, affects systems that run OpenSSH built against musl libc, including Alpine Linux, OpenWrt, and some IoT firmware. Searches for the flaw surged more than 300 percent within hours of its disclosure, and the vulnerability is being actively exploited by a scanner that can leak private keys in about two seconds. The issue sits in the user-space OpenSSH binary rather than the kernel, so containers remain exposed even on fully patched hosts. Guidance published alongside the disclosure includes detection scripts, temporary hardening steps such as disabling password authentication and TCP forwarding, and recommendations to deploy a patched package as soon as one is available.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Disabling SSH Password Login May Not Work: Cloud-init Drop-in Overrides Config

A recent OpenSSH security advisory from Alpine Linux, which reached the top of Hacker News, prompted many administrators to question whether password authentication is really disabled on their servers. The author audited seven VPS instances and found that three still accepted password logins, despite having edited sshd_config long before. The cause was a drop-in file created by cloud-init, which sets PasswordAuthentication to yes and is read before any directives added later in the main file. Because sshd uses the first value it reads, the author's later 'no' setting was silently ignored. The article recommends checking the effective configuration with sshd -T and verifying from outside the server by probing which authentication methods it advertises, and it includes a Python script for auditing multiple hosts without sending any credentials.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Running Vercel cron more than daily on the Hobby plan via an external scheduler

Vercel's Hobby plan limits cron jobs to once per day, and a schedule like */15 * * * * causes deploys to fail. Vercel also notes that Hobby jobs run at some point within the set hour rather than at an exact time. The recommended workaround is to place the job logic in an API route protected by a bearer token stored in CRON_SECRET, then have an external scheduler call that route over HTTP on any desired schedule. The article also advises removing the route's crons entry so deploys stop failing, and notes that each call still counts toward Vercel usage. The author, who works on the scheduler RunLater, promotes it as one option alongside free built-in daily cron for simpler needs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

JSLab adds npm package install, type support, and quick fixes for missing imports

JSLab, a JavaScript and TypeScript scratchpad for macOS, lets users open a package sheet with ⌘I to search the npm registry and add packages by name or exact version. Installed packages are shared across all tabs, so an import added in one tab works in others without a restart, and the editor reads their types for autocomplete and type-checking. When an import is missing, the editor flags it with a quick fix to install the package, and browser tabs show an install button that reruns the code once installation finishes. The sheet also tracks installed and latest versions with update and removal options, while install scripts are blocked by default and JSLab uses its own .npmrc file for registry settings. JSLab is set to launch on November 15.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Perché du e il Finder mostrano dimensioni diverse per la stessa cartella

Lo stesso percorso può risultare con dimensioni diverse in du -sh e nel Finder perché misurano aspetti differenti: la lunghezza dei file oppure lo spazio effettivamente occupato sul disco. Quando il disco si riempie conta soprattutto il secondo valore, e calcolarlo correttamente va oltre la semplice somma di st_size. I file piccoli occupano comunque un blocco intero, mentre i file sparsi riservano una lunghezza elevata usando blocchi solo per le parti scritte. Per evitare conteggi errati, lo scanner descritto non segue i collegamenti simbolici, non attraversa i dischi montati e conta una sola volta gli hard link. I cloni APFS restano il caso più difficile, perché condividono blocchi con l'originale e il conteggio basato sui blocchi può sovrastimare lo spazio recuperabile.

0 comments Read more at DEV Community