The way I read it, it is fine if you do not allow password authentication in general?

castle-nathan.gif

I don't know why, but I always assumed that image was from Firefly. It's the same color shirt and everything!

I can't figure out how to upload gifs to Lemmy...

![alt text - optional, you can keep this empty, but you need the brackets](https://thelemmy.club/api/v3/image_proxy?url=https%3A%2F%2Fwebsite.tld%2Fcastle-nathan.gif)

You'd think that but so far I haven't seen an actual PoC exploit for the PHP vulnerability that doesn't require misconfiguring the server. And this is over a week after the patches were released.

Yep, those new fangled slop-kitties. The worst part is that there brute force hacking is being subsidized by people 401ks.

It's not quite as simple as that. The author in this case followed a pretty specific trail to find the bug.

Where AI helped was as the last step. They already knew what the bug would do and where to look, but actually looking through the source code for all the possible musl implementations out there would have taken a lot of time.

So they brute-forced it instead and asked AI to spin up actual running instances of all those implementations and simply tried the bug against each of them, rather than looking at all the code.

The way it works is that finding vulnerabilities required a lot of technical understanding and mental effort. A software could have a glaring hole in it for years without anyone finding out simply due to nobody really looking. AI just gives you the ability to do rudimentary exploit analysis around the clock without having to spend your own time. This is a wake up call to anyone making software in sloppy fashion.

But it isn’t quite as easy as saying “AI hack into this service”, if the person doing the hacking is using the same model as the person who made the service, and that person already asked the AI to do that and fixed the resulting exploit prior to release.

Even projects that use AI in a limited fashion to code or even not at all, often use AI to at least do some red team stuff prior to release.

I don’t really foresee any way this doesn’t even out eventually.

SSH enabled and the SSH port of the container accessible and it's set for password auth.

Maybe something like git forges and gist alternatives?

Linux phones? PostmarketOS is alpine-based. And a lot of people may ssh to their phone.

Now, now. Starbucks is a very successful business.

"Cyber" ppl love to do this. This is basically their resume I guess? They have to sensationalize absolutely everything they can (not that this isn't an important bug, but this could have been a 1-2 page white paper imo (like many of them))

Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can't have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine's announcement for better info.

https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

Unless it's explicitly installed no. The default Alpine image doesn't come with OpenSSH.