OpenSSH 10.6p2 Critical workaround for alpine without PAM

Portable OpenSSH 10.6p2, released on November 5, 2026, fixes a way to bypass password authentication when logging in over SSH. According to the release notes, the bug affects some Linux systems that use the musl C library and whose sshd, the SSH server, is built and run with PAM support disabled. PAM is the framework many Linux distributions use to check logins. OpenSSH calls the change a critical security workaround: it places the root cause outside sshd but says the bug is exploitable through sshd and can be blocked there. The Hacker News submission names Alpine Linux, a musl-based distribution; the notes themselves describe the affected systems only by musl and disabled PAM.

The same notes explain why a point release like this one is arriving now instead of waiting for the next planned version. OpenSSH says it has received a large number of security reports, many found by AI models or with AI assistance, and that in a number of cases bugs identified by AI tools were later discovered independently by a different researcher. The project concludes that attackers who do not report bugs can probably find them too, so for now it will ship fixes in more frequent releases rather than batching them. The notes do not say how this particular bug was found; it is credited to Özgün Kültekin of Wakefield.

OpenSSH also says many AI-generated reports turn out to have no security impact under a realistic threat model, and that it welcomes them most when a person has triaged them and supplied test cases or proposed fixes. For administrators, the practical reading is that OpenSSH releases between scheduled versions may now carry security fixes and are worth tracking.