Critical Adobe Commerce Flaw CVE-2026-48356 Actively Exploited for Remote Code Execution

OpenSSH Releases Patch for Critical Authentication Bypass Affecting musl-Based Linux Distributions

OpenSSH has issued version 10.6p2 containing a mitigation for a critical vulnerability nicknamed '*sshole' that allows authentication bypass on systems using the musl C library. The flaw affects distributions including Alpine Linux, OpenWRT, Buildroot and Yocto where sshd runs without PAM and password authentication remains enabled. Attackers can log into accounts configured with a single asterisk as the password hash by supplying any password longer than 256 characters. Researcher Özgün Kültekin discovered the issue, which stems from legacy Unix password handling practices still present in modern images such as official AWS and Azure Alpine Linux builds. OpenSSH developer Damien Miller stated the root cause lies outside the project yet OpenSSH is well positioned to mitigate it, prompting an expedited release to prevent discovery by AI agents. Alpine Linux urges users running sshd to update immediately and restart the daemon, or disable password authentication if patching is not yet possible.

Ubuntu Patches APT Vulnerability Allowing Root Access via Man-in-the-Middle Attacks

Ubuntu has released updates addressing a flaw in the APT package manager that could let an attacker positioned for a man-in-the-middle attack gain root privileges on affected systems. The vulnerability, tracked as CVE-2026-109518, enables manipulation of HTTP traffic between a client and archive servers to deliver a malicious .deb package. Exploitation requires the client to retry a failed download, a behavior that is disabled by default starting with Ubuntu 22.04 LTS and later releases. Debian issued patches for the same issue earlier. While digital signatures are intended to prevent such attacks, the flaw allows APT to install the malicious package even when signature verification fails. Scripts inside installed .deb packages execute with root privileges, potentially leading to full system compromise.

OpenSSH Patches Critical Password Authentication Bypass Affecting musl libc Systems

OpenSSH version 10.6p2 introduces a mitigation for a critical vulnerability that allows password authentication bypass on Linux systems using musl libc with PAM disabled. The flaw affects configurations where password verification relies directly on the C library rather than PAM, enabling remote attackers to log in without valid credentials if PasswordAuthentication remains enabled. Systems running Alpine Linux containers or distributions such as postmarketOS, Void Linux musl variant, and certain OpenWRT setups with OpenSSH instead of Dropbear are most exposed. Damien Miller explicitly recommends setting PasswordAuthentication=no or disabling SSH entirely on affected hosts until patched. The issue was reported by Özgün Kültekin of Wakefield and stems from behavior outside sshd itself, though the daemon serves as the attack vector. Alpine Linux quickly issued updated packages, while OpenSSH developers cited rapid AI-driven rediscovery of bugs as justification for short disclosure timelines. No public exploit details or CVE identifier have been released yet.