OpenSSH Flaw Enables Login to Password-Disabled Linux Accounts

A security researcher discovered a vulnerability dubbed "sshole" that allows attackers to log in to Linux accounts even when passwords are disabled, found through 17,600 authentication tests run by AI agents. The flaw exploits an unexpected twist in the OpenSSH code, according to the researcher's account. The finding matters because password-disabled Linux accounts are commonly treated as inaccessible to remote login.

A security researcher recently uncovered a vulnerability, dubbed sshole, that allows hackers to log in to Linux accounts even when passwords are disabled, using a clever combination of AI-powered testing and an unexpected twist in the OpenSSH code. This flaw was discovered through 17,600 authentication tests run by AI agents.