Alpine SSH flaw: any password over 256 chars logs you in on AWS/Azure images
emax · x · 2026-11-05
Security researcher Geoffrey Huntley urges everyone to update now: the default user on Alpine's official AWS and Azure images accepts any password longer than 256 characters.
- Affects sshd with password auth on Alpine, OpenWrt and any musl-based box
- A six-panel comic traces the bug's origins: from Bill Joy's 1980 "The Devil himself" daemon hash placeholder, to musl's crypt() crash workaround returning "", to a 2016 salt-borrowing bug
- The flaw went unnoticed for a decade — "wordlists don't have 300-letter passwords" — until Huntley found it fuzzing sshd (with some help from agent swarms)
More from Fun
- Tracking where his dog pees on walks: a quirky personal data-logging project — aaraalto · 2026-11-06
- AI comp packages are '500k cash + 15m equity' yet influencers claim hundreds of millions — teodorio · 2026-11-06
- Critics extend Dario's 'adults have more moral worth than babies' remark to billionaires — fkasummer · 2026-11-06
- Fan creates stunning AI-generated Terraria short film — sadelcri · 2026-11-06
- Pliny speculates labs are using unguardrailed unreleased models to reverse-engineer the web — bradneuberg · 2026-11-06
- MOSS Base image model nails an absurd multi-element prompt in one shot — cgs019283 · 2026-11-06