OpenSSH 10.6p2 Critical workaround for alpine without PAM

OpenSSH 10.6p2, released November 5, 2026, provides a critical workaround for a password-authentication bypass affecting some Linux systems built and run without PAM, including Alpine-style musl environments. The OpenSSH team says the underlying cause lies outside sshd, but the vulnerability can be exploited through the SSH server and the release prevents that route. The update also includes fixes already committed to the 10.6 stable branch. The team says it plans more frequent releases in response to a rise in security reports, including findings from AI tools, so fixes reach users sooner.

The broader 10.6 changes add a hybrid post-quantum ML-DSA/Ed25519 signature algorithm, server-side warnings for non-post-quantum key exchange, and improved FIDO credential protections. New configuration and command-line options expand control over agent sockets, authentication key checks, forwarding keepalives, and SFTP directory creation. Other fixes address key parsing and KDF limits, timeout matching, crashes, signal handling, and security sandbox rules. On a small set of older or specially configured platforms where post-login SSH processes retain root privileges, forwarding features are disabled because they could bypass user-level restrictions. The notes also warn that scp’s remote-to-remote `-R` option is deprecated and will eventually be ignored.