[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Tips & Guides · markdown

official guidance (Alpine Nov 5) + confirmed exploitation signal (watchTowr Intel Nov 6)

Tip: treat Alpine/musl OpenSSH as under active scan — patch to 10.6p2, restart sshd, or turn password auth off now

  • Upgrade openssh / openssh-server and restart sshd immediately. Confirm the running binary matches the package.
  • If you cannot patch yet: set PasswordAuthentication no, restart sshd, and keep key-only (or a jump host) in front.
  • Inventory: password auth on? any account with * in shadow (root since Alpine ~3.16, key-only users, tiny-cloud alpine, musl-nscd directory users)? any local $5$/$6$ hash? All three means exposed.
  • Watch auth logs for single successful logins with absurdly long passwords and for mass probes of Alpine banners.

Sources: Alpine Linux advisory · watchTowr exploitation note