OpenSSH 10.6p2 released with critical vulnerability workaround
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
OpenSSH released version 10.6p2 with a workaround for a critical login-bypass bug on musl libc Linux systems.
Alpine Linux users are most exposed; the fix isn't on every download server yet.
Background
OpenSSH is the widely used open-source suite for encrypted remote login (SSH). The bug affects Linux systems that use musl libc (an alternative to the common glibc C library) with PAM (pluggable authentication modules) disabled — Alpine Linux is the named example. OpenSSH developer Damien Miller said the root cause lies outside OpenSSH itself but a mitigation could be shipped quickly, and the project learned of the issue only the day before release, when Özgün Kültekin of AI security company Wakefield reported it.
How it unfolded
- Nov 5, 2026OpenSSH 10.6p2 is released with a workaround for a critical vulnerability affecting Linux systems using musl libc with PAM disabled, such as Alpine Linux.
- Nov 5, 2026Developer Damien Miller posts the advisory on Hachyderm.io urging affected administrators to act immediately; Alpine Linux developers publish the same warning.
- Nov 5, 2026The update is available for Alpine, but other distributions and many OpenSSH download servers still offer the previous version, 10.6p1.
- Nov 5, 2026Miller clarifies the bug also applies to builds compiled with --with-pam but configured with UsePAM no, saying the release notes' "and" should be read as "or"; Alpine plans to backport the fix to Alpine 3.16.
Key terms
- musl libc
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- PAM
- A mechanism that integrates multiple low-level authentication schemes into a high-level API, letting programs authenticate independently of the underlying scheme.
- backport
- The process of porting a software update made for a newer version of software to an older version.
Source: Wikipedia
Who’s saying what
- Official
- Miller urged operators of musl libc systems without PAM to set PasswordAuthentication=no or disable SSH immediately, and said the release was rushed because AI agents have been rediscovering bugs within hours.
- Analysts
- Hacker News commenters noted the bug is in musl rather than OpenSSH, with one calling the quick fix simply PasswordAuthentication=no.
- Caution
- Hacker News commenter entuno found it confusing that the release notes call it a critical security workaround while nothing appears on the OpenSSH security page.
Still unverified
Hacker News commenter entuno noted nothing about the issue appears on the OpenSSH security page, though it may not yet have been updated; commenters phoronixrly and manwe150 said in the thread that Dropbear is presumed not affected, without confirmation from the project.