Researchers disclosed a vulnerability stemming from how OpenSSH interacts with musl, the lightweight C library used by Alpine Linux, when PAM authentication is not used. On systems meeting specific conditions—including passwordless accounts marked with an asterisk in /etc/shadow and at least one SHA256/SHA512-hashed account—an attacker can log in via SSH without any password, succeeding on the first attempt with no retries needed.
arstechnica.com
· 2026-11-05
A developer posted Rustable on Show HN, an open source database client built in Rust using the egui GUI framework. It supports multiple simultaneous connections with separate windows, SSH tunnels, schema browsing, SQL tabs, saved queries, and reviewable edits before saving, with more database engine support planned.
rustable.app
· 2026-11-03
NVIDIA has notified Brev cloud platform customers of a security incident involving unauthorized activity between October 4 and October 20. The company said SSH keys stored on the platform may have been exposed to attackers, and it has since rotated the affected keys and updated customer virtual machines with new ones. NVIDIA says it found no evidence the compromised keys were misused.
tomshardware.com
· 2026-11-02
A tampered version of Anthropic's Claude Code VS Code extension, labeled version 2.1.313, was available on Cursor's extension marketplace for about 11 hours on October 29, reaching as many as 5,000 developers. Security researchers at Phorion and OpenSourceMalware found the attackers inserted malicious JavaScript into the extension's main file that ran automatically on load, without any user interaction with Claude Code.
bleepingcomputer.com
· 2026-10-30
Security firm Phorion identified that version 2.1.313 of the official Claude Code extension for VS Code, distributed via the Cursor Marketplace, contained a hidden SSH backdoor targeting macOS, Linux, and Windows systems. Cursor has since removed the affected release from its marketplace and pulled the corresponding NPM and VS Code packages from their registries.
phorion.io
· 2026-10-30
Tailscale says its security and engineering teams, aided by outside specialists, have found multiple vulnerabilities in Tailscale SSH, most involving privilege escalation that could let an already-authorized user act beyond their configured permissions. The company has fixed most issues and is targeting a patched client release by the end of Tuesday, October 27, while continuing to assess remaining findings.
tailscale.com
· 2026-10-27
Ghostty's 1.4.0 release delivers performance and memory improvements, a complete Kitty graphics protocol implementation including animation, and SSH integration upgrades, built from 2,889 commits by 172 contributors over seven months. The maintainers also disclosed and patched five security vulnerabilities, including paste-protection and tmux control mode crashes affecting versions 1.3.0 and 1.3.1.
ghostty.org
· 2026-10-27
Security researchers at Cyberdione Labs identified 11 vulnerabilities, collectively dubbed Tailworm, in Tailscale 1.104.2 and self-hosted headscale v0.29.5 that remain unpatched. The most severe flaw lies in Tailscale's embedded SSH server, where unix-socket forwarding bugs could let an authorized device gain root-level code execution, steal enrollment keys, or delete arbitrary root files on a target machine. Founder Erica Windisch said the issues were confirmed in a lab using unmodified released software and were disclosed publicly to speed up fixes.
bleepingcomputer.com
· 2026-10-27
A new tool called Corgi was shown on Hacker News as a terminal multiplexer designed to manage both human workflows and AI agents like Claude Code, Codex, Pi, and OpenCode in one interface. It tracks agent status (working, needs attention, finished, idle), keeps sessions and processes running in the background, and shows file changes and token usage per workspace. Corgi is installable via a curl script and supports features like image pasting over SSH, worktree organization, and scripting via a '--skill' command.
corgi.computer
· 2026-10-23
A security researcher reported that attackers compromised a Tor management server in late August using a reused password, then installed the Ebury Linux backdoor and gained control of a second server called Switzerland2. From there they reconfigured 333 exit relays between October 2 and 5 to redirect SSH traffic to attacker-controlled servers and block ports used for encrypted email while leaving unencrypted email ports open.
arstechnica.com
· 2026-10-22
A developer published a tutorial explaining how Mac users can generate SSH authentication keys stored in the Secure Enclave rather than as traditional key files. The process uses three terminal commands, requires Touch ID verification, and includes steps for linking the resulting key to GitHub for git-over-ssh use.
nmattia.com
· 2026-10-21
A security researcher discovered that 333 Tor exit relays—about 10% of the network—had been infected since August with the Ebury SSH backdoor and were coordinating a man-in-the-middle attack on SSH connections starting October 2. The compromised nodes redirected SSH traffic to 12 interception servers that stole passwords and harvested unencrypted mail traffic, prompting the researcher's report that led to the removal of the infected exit nodes from the Tor network.
kaba.cx
· 2026-10-20
GoKawiil