Binance founder CZ warns of critical 10-year-old OpenSSH flaw

Binance founder Changpeng Zhao (CZ) has warned server operators about a critical OpenSSH authentication vulnerability affecting certain Alpine Linux systems, urging them to install security fixes after developers discovered that the flaw had existed for nearly 10 years. Summary Binance founder CZ has urged server operators to patch a decade-old OpenSSH authentication bypass vulnerability immediately. The flaw affects certain musl-based Linux servers using password authentication without PAM protection enabled during logins. Attackers could access vulnerable accounts using oversized passwords without knowing their actual credentials or private keys. OpenSSH released version 10.6p2, while Alpine Linux published security fixes for affected operating system releases. Some Alpine cloud configurations could expose administrative privileges, although no confirmed exploitation had been publicly reported. In a November 6 post on X, Zhao drew attention to the security issue after OpenSSH and Alpine Linux released fixes on November 5. The vulnerability can allow attackers to access certain accounts without knowing their passwords, including accounts normally configured to accept only SSH keys...