urgent security release: 10.6p2

[Chris Rapier]

This is minor but there don't seem to be a branch or tag specifically 
for V_10_6_P2. Am I missing it?

Chris

On 11/5/26 04:10, Damien Miller wrote:
> OpenSSH 10.6p2 has been released with a workaround for a critical
> vulnerability.
> 
> https://openssh.com/releasenotes.html#10.6p2
> 
> If you operate a Linux system that uses musl libc without
> PAM (Alpine Linux is one example) then stop reading and set
> PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.
> 
> This vulnerability does not exist on non-Linux systems, Linux/glibc
> systems and Linux systems that use PAM for password authentication.
> 
> We consider the root cause of this bug to be outside OpenSSH itself, but
> we're in a good position to deliver a mitigation quickly.
> 
> We are making this release as fast as possible (we learned of the
> problem yesterday) because we have recently observed multiple cases of
> rapid bug rediscovery by AI agents, sometimes within hours, and so now
> consider long embargo periods to be a dangerous practice that primarily
> benefits attackers.
> 
> Thanks for Özgün Kültekin of Wakefield (wakefield.co) for reporting this
> problem to us and for the Alpine Linux developers for making an updated
> release available at very short notice.
> 
> -d
> _______________________________________________
> openssh-unix-dev mailing list
> openssh-unix-dev at mindrot.org
> https://lists.mindrot.org/mailman/listinfo/openssh-unix-dev