The emergency OpenSSH fix belongs on your Alpine hosts today. thehackernews reports a flaw that lets attackers log in to accounts that have no password, such as SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. Tom's Hardware reports a PHP post-mortem showing that a small team of maintainers knew about the bug two years before it was made public, while the chained PHP2Shell exploit ravages servers. And bloomingbit reports BitMart was hacked again ahead of its shutdown, with the founder saying the security team is severely understaffed.
The shared theme is that the code guarding your accounts is maintained by fewer people than its install base suggests. We review payment and account flows for security, and we take over undocumented code. Message us for cost and timeline within a day.