The Week You Could Get Root Without a Password

An Alpine login you could skip by typing nonsense, 2.1 million Linux servers exposed to a kernel race, a Debian package swapped after its check, the White House renting itself out as a proxy, and how Binance’s $6.3 billion heist began.

Welcome to Friday. If last week was about money walking out of a hot wallet, this week was about the doors we leave ajar on purpose. A password you never needed. A package that looked verified until it wasn’t. A freezer that decided blood should be warm. The tools we treat as boring plumbing (OpenSSH, APT, the kernel’s TCP handshake) spent the week reminding us they are load-bearing.

The other thread is speed. AI agents rediscovered bugs inside embargo windows. Attackers scanned the whole internet before Ubuntu had a patch. A record heist started with a fake MacOS tool. None of it needed new magic, just us trusting the defaults one more week. So pour something nice, and let’s go through it.

In this issue

1. On Alpine, type enough nonsense and you get root
2. One handshake from root on 2.1 million Linux servers
3. APT said the package was fine. But it wasn’t.
4. The White House as a residential proxy
5. How Binance’s $6.3 billion heist began
6. ICD exclusive: Pharmagest’s open VNC, plus four more stories worth your attention

🔴 CRITICAL · OPENSSH / ALPINE

1. On Alpine, type enough nonsense and you get root

OpenSSH rushed out a fix for a critical flaw that lets attackers log in without the right password on some Linux servers. It hits systems built on the musl C library with PAM turned off. Alpine is the best-known example. Systems using glibc or PAM are not affected.

The fix is OpenSSH 10.6p2, which works around the bug. Damien Miller says the root cause sits outside OpenSSH. If you can’t patch yet, his advice is to disable password logins, or SSH entirely, “IMMEDIATELY.”

The timeline was brutal: Miller’s team learned of the bug just a day before the fix. He argues long embargoes now mostly help attackers, because AI agents rediscover the same bugs, sometimes within hours.

Why it matters: The demo: type 257 to 1,024 characters of anything at the password prompt and you’re root.

🔴 CRITICAL · LINUX KERNEL · CVSS 9.8

2. One handshake from root on 2.1 million Linux servers

Attackers are scanning the whole internet for Linux servers exposed to a critical kernel flaw, and Marcus Hutchins says they’ve already found about 2.1 million that accept the vulnerable connection. CVE-2026-98432 is a race condition in the code that handles incoming IPv4 TCP connections: a remote attacker can run commands as root during the handshake, with no login at all. When the scanning news broke, Ubuntu still had no patch.

Why it matters: It's critical and attackers have counted every vulnerable target before the vendors have finished the patch.

🟠 HIGH · DEBIAN · SUPPLY CHAIN

3. APT said the package was fine. Then it wasn’t.

A flaw in APT, the tool that installs software on Debian Linux, lets a network attacker swap a package after it passes verification and run code as root. CVE-2026-109518 sits in resumed HTTP downloads. When a redirect gives two different downloads the same address, APT can merge them, and a man-in-the-middle can alter the file after the check has passed. Debian fixed it in apt 3.0.4 for Debian 13. Per Debian’s changelog, the fix is four words long: “Open target files exclusively.”

Why it matters: A valid signature is not the same as a safe install path. If your fleet still resumes APT downloads over plain HTTP on untrusted networks, treat today as patch day, not reading day.

🔎 INVESTIGATION · RESIDENTIAL PROXIES

4. The White House as a residential proxy

Threat-intel firm Layer3 Intel says the White House network has been working as a residential proxy: traffic from paying strangers came out through it 236 times in a month. Layer3 bought a few dollars of proxy access and watched traffic exit from six IP addresses registered to the Executive Office of the President, through 28 different proxy services.

About half of it ran between 5pm and midnight Eastern, which Layer3 reads as someone’s personal device rather than guest Wi-Fi. The firm says it has kept the raw logs for any agency that asks.

Why it matters: You can spend a fortune on perimeter slides and still lose the plot to one compromised device in your network. Residential proxy abuse is usually a story about random home routers. This week, the exit node sat next to the seal.

🧾 POST-MORTEM · BINANCE · $6.3B

5. How Binance’s $6.3 billion heist began

Binance has explained how it was breached, and it started with two lures aimed at its engineers.

Lure one: an engineer searching for an AI coding tool installed a tampered version of Homebrew, the Mac package manager. Binance caught it, but the attackers still learned who worked on its wallets.

Lure two: another engineer ran a coding test for a fake job on a work computer. The test hid malware that Binance’s security missed. From there, the hackers used Binance’s own internal AI tool to take over two wallet engineers’ access, and stole a record $6.3 billion.

Why it matters: Last week’s number finally has a beginning: a poisoned Mac tool, a fake job interview, and an internal AI assistant that became part of the kill chain.

Also worth your attention

• Apple will scan public iCloud links. Apple will check every photo and file shared through a public iCloud link for harmful content. From iOS 27.3 it may delete flagged items or bring in law enforcement, without saying what counts as harmful.
• Discord drops Electron. Discord is rebuilding its desktop app in Rust. An early build in a screenshot from its CTO uses about 290MB of RAM. For the past year, Discord has been testing automatic restarts for the current app once it goes past 4GB.
• Root exploits at about $1,300 a bug. OpenAI says one run of an unreleased hacking model built working root exploits for 948 Linux kernel flaws for about $1.2M, roughly $1,279 per flaw.
• Fridge hacks reach the blood supply. The European fridge-hack wave hit France’s blood supply freezers, pushing Coolworld units used by blood service EFS from −30 °C toward +110 °C before an on-call technician caught it. The Health Ministry says there was no operational impact.

Before you log off

This was a week about the gap between a control that exists and a control that holds. Password auth that could be skipped. A verified package that could still be swapped. A freezer that cheerfully accepted a new setpoint from the internet. A proxy exit that turned out to be the Executive Office of the President.

Tonight, close the laptop. You’ve earned it.