urgent security release: 10.6p2

[Turritopsis Dohrnii Teo En Ming]

On Thursday, November 5th, 2026 at 8:12 PM, Damien Miller <djm at mindrot.org> wrote:

> OpenSSH 10.6p2 has been released with a workaround for a critical
> vulnerability.
> 
> https://openssh.com/releasenotes.html#10.6p2
> 
> If you operate a Linux system that uses musl libc without
> PAM (Alpine Linux is one example) then stop reading and set
> PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
> 
> This vulnerability does not exist on non-Linux systems, Linux/glibc
> systems and Linux systems that use PAM for password authentication.
> 
> We consider the root cause of this bug to be outside OpenSSH itself, but
> we're in a good position to deliver a mitigation quickly.
> 
> We are making this release as fast as possible (we learned of the
> problem yesterday) because we have recently observed multiple cases of
> rapid bug rediscovery by AI agents, sometimes within hours, and so now
> consider long embargo periods to be a dangerous practice that primarily
> benefits attackers.
> 
> Thanks for Özgün Kültekin of Wakefield (wakefield.co) for reporting this
> problem to us and for the Alpine Linux developers for making an updated
> release available at very short notice.
> 
> -d

Noted with thanks.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Targeted Individuals Singapore