OpenSSH 10.6p2 Released

OpenSSH 10.6p2 is an urgent security release addressing a password-authentication bypass affecting some Linux systems built and run without PAM, specifically systems using musl libc such as Alpine Linux. The OpenSSH team says the underlying defect lies outside OpenSSH, but sshd can be exploited through it and the release adds a workaround. Operators of affected systems should immediately disable password authentication or turn off SSH until they can update. The issue does not affect non-Linux systems, Linux systems using glibc, or systems using PAM for password authentication. The flaw was reported by Özgün Kültekin, and Alpine developers quickly prepared an updated release.

The release also includes fixes already made on the 10.6 stable branch, including allowing a post-quantum hybrid signature algorithm for certificate authorities, portability improvements, and corrections to signal handling and sandbox behavior. OpenSSH plans to issue fixes more frequently because AI-assisted discovery has made rapid, independent rediscovery of vulnerabilities more likely, increasing the risk that attackers will find flaws during lengthy disclosure delays. The release notes also warn that scp’s remote-to-remote `-R` option will eventually be disabled because it is fragile, requires credentials on the remote host, and can create risks from differing shell-quoting rules. Support for certain old platforms may also be removed unless users help develop alternatives.