Tag: devsecops
sshhole (CVE-2026-123158): The OpenSSH Bug That Logs Into Alpine Without a Password, and How to Fix It
A musl quirk makes OpenSSH accept a too-long password for passwordless accounts on Alpine Linux and many Docker images. Ubuntu and Debian are safe. Who is affected, a 10-second check, and the two-command fix.
Read more →
The $6.3B Binance Hack Started With One Laptop: Fake AI Tool, Fake Job Interview and One Token
According to Binance's initial findings, the largest crypto hack on record began five months earlier with a developer searching for an AI coding tool. The attack path step by step, and five lessons for every developer.
Read more →
CVE-2026-98432: A Single Packet, No Login: The 9.8 Linux Kernel TCP Bug and How to Protect Your Server
A use-after-free in the Linux kernel's TCP connection setup can be reached by a crafted packet before any login. What it is, why Ubuntu's fix isn't out yet, and the stopgaps you can apply today.
Read more →
The GitLab 10/10 Flaw (CVE-2026-97229, GitLab2Shell): Why Updating GitLab Might Not Be Enough
One crafted regular expression in a CI/CD config can run code on a self-hosted GitLab server, no login needed. Alpine Linux updated and was still vulnerable. How to check, upgrade and verify.
Read more →