No Password Needed 🔓 SSH Bug Opens Linux Doors + 7.7M Customers Exposed

Today's top threats hit two very different targets: the servers quietly running behind the scenes, and the personal data of millions of everyday shoppers. Here's what you need to know.

*sshole: Type a Really Long Password, Walk Right In

Researchers disclosed a bug nicknamed "*sshole" that lets attackers log in to some Alpine Linux systems without knowing the password at all. The trick is almost absurdly simple: send more than 256 characters in the password field, and on vulnerable setups, you're in on the very first try. Alpine is a lightweight Linux popular in containers, cloud servers, and connected devices, so it often runs places people forget to check. The good news: Alpine and OpenSSH have already shipped fixes. If your team or vendors run Alpine-based systems, make sure they're patched now, not next quarter.

Read more

7.7 Million Customers Caught in a Cloud Vendor Breach

Japanese consumer goods maker Iris Ohyama says a third-party cloud service it relies on was breached, exposing data on 7.7 million current and former customers. The leaked info includes names, home addresses, phone numbers, emails, dates of birth, gender, and account passwords (which the company says were encrypted, without sharing details). That's a goldmine for convincing phishing emails and scam calls. The bigger lesson for businesses: your data is only as safe as the weakest vendor holding it. If you've ever shopped with Iris Ohyama, change that password and anywhere you reused it.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.