OpenSSH rushes out 10.6p2 as AI agents rediscover critical bugs within hours
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
OpenSSH 10.6p2 ships a workaround for a critical vulnerability affecting Linux systems using musl libc without PAM, such as Alpine Linux, which should disable password authentication immediately. The bug doesn't touch non-Linux, glibc, or PAM-based systems. Maintainer Damien Miller says the root cause lies outside OpenSSH, but the team moved fast because AI agents have been rediscovering bugs within hours, making long embargoes dangerous.
We have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers.