OpenSSH musl bypass, weak plugin key, and Xen advisories

Several disclosures hit oss-security, headed by an OpenSSH password authentication bypass tied to musl libc and a recoverable 31-bit signing key in a widely installed WordPress plugin. Further reports cover critical remote code execution in end-of-life Apache Axis, guest-triggered use-after-free flaws in Xen Linux backends, and smaller issues in Apache James, Python FIPS mode, and Axis2.

OpenSSH password bypass with musl crypt

OpenSSH 10.6p2 addresses a password authentication bypass that occurs when musl libc crypt(3) returns '' on long inputs for hash entries that themselves begin with ''. The interaction lets authentication succeed when it should fail. Deployments pairing OpenSSH with musl-based systems need the update to close the hole.

31-bit NOSSL key recovered in InfiniteWP Client

The InfiniteWP Client WordPress plugin, present on roughly 200,000 sites, ships a NOSSL signing key containing only 31 bits of secret material. The key was recovered live in under five minutes, enabling offline brute-force and forged commands. Administrators running the plugin must replace the weak key material to stop unauthorized remote control.

Unauthenticated RCE in EOL Apache Axis 1.x

CVE-2026-90436 discloses unauthenticated remote class instantiation through the SOAP fault exceptionName field in Apache Axis 1.x. The end-of-life codebase permits critical remote code execution via deserialization. Remaining users should migrate off Axis 1.x without delay.

Xen XSA-528: xen-blkback use-after-free

Xen Security Advisory 528 (CVE-2026-100082) describes a use-after-free in the Linux xen-blkback driver that a guest can trigger while reading statistic data. The result is a denial-of-service condition on the host. Operators of affected Xen hosts should apply the supplied patches.

Xen XSA-526: xen-netback use-after-free

Xen Security Advisory 526 (CVE-2026-100080) covers a guest-triggered use-after-free in Linux xen-netback from version 4.11 onward. Exploitation can crash the host. Xen administrators using the netback driver need to install the fixes.

Path traversal in Apache James ManageSieve

CVE-2026-76168 reports a cross-user path traversal in the ManageSieve file implementation of Apache James. An attacker can inject SIEVE scripts into another user's context; the flaw is corrected in 3.9.1. James operators should upgrade to eliminate the injection path.

FIPS hash regression limited to Python 3.14.10

CVE-2026-119170 records a regression in FIPS-mode enforcement of hash algorithms that affects solely Python 3.14.10. The announcement stands alone with no follow-up discussion. Users of that exact release under FIPS constraints should confirm hashlib behavior or move to a corrected build.

SSRF via schema imports in Apache Axis2/Java

CVE-2026-120832 details a moderate-severity server-side request forgery arising from WSDL and XSD schema import resolution in Apache Axis2/Java. Version 2.0.2 contains the fix. Axis2 deployments should apply the update to block the SSRF vector.