Musl flaw could bypass SSH password checks on Linux systems

On the SANS Internet Storm Center’s Friday briefing dated 6 November 2026, researchers note two notable items. First, vulnerability researchers highlight that a vulnerability in the musl C library—affecting SSH when musl is used instead of glibc—could allow a password longer than 256 characters to be treated as valid.

Alpine Linux, OpenWrt and other small-footprint systems commonly use musl, and the conditions to trigger this flaw include an SSH daemon that is enabled, permits password-based logins, and does not use libpam. A simple test is to attempt an empty password for a user without a password and then submit a password longer than 256 bytes; if the login succeeds, the system is vulnerable.

The SSHhole site provides a walkthrough of the vulnerability details, which underscore how API or library changes can lead to incorrect authentication conclusions and potentially widespread exposure.

Second, the briefing reports several discrete items of practical relevance. United States government agencies issued a brief advisory aimed at owners of refrigeration and other OT (operational technology) systems, urging network exposure reduction, OT isolation, credential hardening, and patch application to help mitigate attacks that have spoiled food at grocery stores and on military bases.

In addition, Zyxel GS1900 series switches received a firmware update to address a vulnerability currently being exploited; Binarly credits the discovery of a malware repository containing a Python exploit script linked to this family of fixes. Binarly notes that attackers typically leverage available access to steal configuration data, including hashed passwords, from affected switches. The advisory notes that an attacker would need network access to launch the exploit.