vulnerability

sshole: the OpenSSH bug that lets a long password open an account with no password

On 5 November 2026 the OpenSSH project shipped an emergency release, OpenSSH 10.6p2, to close a password authentication bypass. The researcher who found it, Özgün Kültekin of Wakefield, named it sshole. It is tracked as CVE-2026-123158 and scored 8.1 (high) on CVSS 3.1. In plain terms: on some Linux systems, an attacker can log into … Read moresshole: the OpenSSH bug that lets a long password open an account with no password

PHP2Shell Explained: How an Out-of-Memory Error Became Remote Code Execution

On 21 October 2026, the PHP project shipped an emergency release to fix two critical vulnerabilities that live in the PHP engine itself, not in any application running on top of it. Researchers named them PHP2Shell, and the name is a promise: send the right HTTP requests to a vulnerable server, no login required, and … Read morePHP2Shell Explained: How an Out-of-Memory Error Became Remote Code Execution

Collaborations & press enquiries: s-foot-aade7b@nomadscrolls.net · s-foot-0096cd@nomadscrolls.net · s-foot-7ad09f@nomadscrolls.net · full contact directory