sshhole bug analysis: MUSL-based systems hit hard, up to 500M OpenWRT routers were at risk

esrtweet · x · 2026-11-06

esrtweet shares an early analysis of the newly disclosed sshhole bug: it is severely dangerous for Alpine Linux and other systems using MUSL as their C library. The worst-case scenario could have opened a root-access hole in OpenWRT routers — perhaps 30% of them, roughly 100-500M units worldwide — which the author believes was narrowly avoided.

Findings are unconfirmed because ChatGPT refused to help with the security analysis; the author is asking credentialed infosec researchers to verify. He first learned of it from a friend's urgent warning to unplug OpenWRT routers immediately.

Related event: sshhole: OpenSSH on musl Linux accepts any 256+ character password for locked accounts since 2016(12 posts)→

Original post →

More from Infra

Infra channel →