Alpine Linux flaw let attackers bypass SSH login checks
Heads up if you use Alpine Linux or similar systems: there was a serious security bug that let attackers sneak past SSH login checks if PasswordAuthentication was on and PAM was off.
Basically, by sending an extra-long password, hackers could get into accounts even when passwords were supposed to be disabled.
Alpine Linux urges updates, restart SSH
Alpine quickly patched the issue for versions 3.16 to 3.24 and is urging everyone to update right away and restart SSH services.
Systems like Adelie, Void, and OpenWrt were also potentially vulnerable, with tiny-cloud images being especially at risk if a "6 hash" showed up.
While root accounts were not directly exposed in most cases, attackers could still take over other user accounts, so it is smart to turn off password authentication, check your logs for anything weird, and make sure all updates are installed as soon as possible.