OpenSSH flaw lets attackers log into password-disabled Linux accounts

A newly disclosed OpenSSH vulnerability ("sshole") impacts OpenSSH servers on musl-based Linux distributions (e.g., Alpine, OpenWrt) when PAM is disabled and SSH password authentication is enabled: an oversized password causes musl's crypt() to return '*' which can match accounts with '*' in /etc/shadow, permitting login. The report describes affected conditions, exploitation details, detection commands for suspicious Accepted password log entries, and remediation (upgrade to OpenSSH 10.6p2 or disable PasswordAuthentication).