hajime retweeted
‼️BREAKING: A critical flaw in Synology NAS devices lets attackers read and write any file on them without logging in.
The SQL injection bug in their login system scores 9.8 out of 10. A second flaw, in rsync, skips the login too.
Synology patched both today. Update ASAP.
Readers added context they thought people might want to know
Synology did not patch these flaws "today"; the DSM security updates (e.g. 7.4.1-90080-1 and branch equivalents) were released in October 2026, with the Nov 10 advisory disclosing details of those already-available fixes.
synology.com/en-global/secu…
synology.com/en-us/releaseN…
hajime retweeted
🔴 CRITICAL 9.5 · React: remote code execution in server components (CVE-2026-126187)
An unauthenticated attacker can run arbitrary code on the server by sending a crafted request, without logging in.
👉 Fix: 19.0.9, 19.1.10 and more
cve.now/CVE-2026-126187?utm_…
hajime retweeted
セキュリティ専門団体が不正アクセス被害、最大1.5万件の情報漏えいか ID・パスワードも対象に weekly.ascii.jp/elem/000/004…
hajime retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Readers added context they thought people might want to know
Exploitation requires specific conditions, not just typing a long string anywhere on Alpine: sshd built without PAM, password auth enabled, a target account with a '*' password field, and another local account with $5$/$6$ hashes. Root login also must be explicitly permitted. alpinelinux.org/posts/2026-11-… openssh.org/releasenotes.h…
hajime retweeted
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
