If you run anything on Alpine Linux, go check your SSH today. The Hacker News reports an emergency OpenSSH fix for a flaw that lets an attacker log into accounts with no password at all, key-only accounts included, on some Alpine servers running the standard openssh-server package. All it needs is network access and an account name. Tom's Hardware reports a PHP post-mortem: the bug was known to its small group of maintainers two years before it went public, and a chained exploit called PHP2Shell is ravaging servers meanwhile. bloomingbit reports BitMart was hacked again ahead of its shutdown, with its founder saying the security team was severely understaffed. In all three the fix or the knowledge existed somewhere, and what was missing was someone whose job it was to apply it. We review payment and account flows and take over systems nobody currently owns, and a small review takes days, not months. Send us a list of what you run and we will come back with cost and timeline within a day.
Was this useful?