OpenSSH rushes out 10.6p2 to patch a password bypass on musl Linux systems
OpenSSH 10.6p2 Critical workaround for alpine without PAM
OpenSSH 10.6p2 is a critical security workaround for Linux systems using musl libc with PAM disabled, where sshd could allow a password authentication bypass. The bug was reported by Özgün Kültekin of Wakefield. The release also enables the post-quantum ssh-mldsa44-ed25519 signature scheme as an allowed CA algorithm and fixes a CPU spin tied to ChannelTimeout. The team notes a surge of AI-assisted bug reports and will ship fixes more frequently.
We have seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher. This suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too.