A burglar got into this server with a banana.

On some Alpine Linux servers, accounts that should never take a password take any password. Alpine's advisory says an attacker who can reach the SSH port "can log in without knowing any password", and the fix is out: update OpenSSH, restart it, or turn password logins off.

Source: "*sshole", sshhole.com, Nov 5, 2026 (Özgün Kültekin) https://sshhole.com/ Security advisory: openssh-server password authentication bypass, Alpine Linux, Nov 5, 2026 https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/

The house, the burglar, the banana and the contractors are dramatizations; the banana stands for "any password" and is not how the attack works. Every quote and number on screen is from the sources. Debian, Ubuntu and systems that use PAM for password logins are not affected.

Does your server still accept password logins?