OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability

The vulnerability is described as affecting Linux systems running OpenSSH with musl libc and without PAM. Commenters characterize the root cause as musl’s handling of the crypt API, while noting that OpenSSH can ship a workaround by treating an unusually short return as an error. One commenter feared exploitation could be as simple as entering any password for an account with `*` in `/etc/shadow`; others focused on the apparent flaws in the API and musl’s implementation. Commenters said glibc systems, systems using PAM, OpenBSD, and Dropbear are unaffected. OpenWrt users raised concerns because of its use of musl, while another commenter noted that lightweight containers may not run an SSH server. One commenter also questioned why the critical release was not reflected on OpenSSH’s security page.

The vulnerability prompted debate over whether SSH password authentication should be disabled. Some commenters called `PasswordAuthentication=no` good general advice, while others pointed out that passwords can provide a recovery route when keys or devices are unavailable, or can be required alongside a public key. Replies argued that reliable access depends on protecting keys and maintaining recovery options: suggestions included encrypted backups, a password manager, or a printed master credential stored securely. Others said recovery should rely on physical access to a trusted computer, not remote password login, and that losing all devices would make account access a secondary concern.