OpenSSH 10.6p2 ships a password bypass workaround for musl Linux systems

OpenSSH developer Damien Miller released Portable OpenSSH 10.6p2 on November 5th, 2026, shipping a workaround for a critical password authentication bypass affecting musl Linux systems without PAM, and urged operators to disable password authentication or SSH entirely. OpenSSH said AI-driven rediscovery of vulnerabilities has made long embargoes dangerous, a concern given that OpenSSH is default remote-access infrastructure across servers and containers and minimal musl systems often skip PAM.

OpenSSH 10.6p2 ships a password bypass workaround for musl Linux systems Damien Miller shipped OpenSSH 10.6p2 on November 5th for musl Linux systems without PAM, urging operators to disable password authentication or SSH. By RuntimeWire Staff https://runtimewire.com/author/runtimewire-staff · Published Primary source: Hacker News https://hachyderm.io/@damienmiller/117563026759098135 Why it matters OpenSSH is default remote-access infrastructure across servers and containers. A password authentication bypass on musl Linux without PAM puts minimal systems that often skip PAM at risk, and OpenSSH says AI-driven rediscovery has made long embargoes dangerous. Damien Miller, the longtime OpenSSH developer who started working on the project in 1999 https://www.openssh.org/history.html?ref=runtimewire to port it to other platforms, announced OpenSSH 10.6p2 on November 5th, 2026 https://hachyderm.io/@damienmiller/117563026759098135?ref=runtimewire with a workaround for a critical password authentication bypass. The OpenSSH release notes https://openssh.com/releasenotes.html?ref=runtimewire 10.6p2 date Portable OpenSSH 10.6p2 to November 5th, 2026.… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.