OpenSSH 10.6p2 shipped on November 5, 2026, and it closes a critical password authentication bypass. On affected systems, anyone who can reach the SSH port can log in without knowing a password. If you run sshd on musl-based Linux with pluggable authentication modules (PAM) disabled, Alpine Linux being the common example, upgrade today. At Check Point Software, our testing adds two points to the public advisory. The attack needs a second account that is active and has a real password, because a stored hash alone is not enough. Two conditions are also visible remotely before login: the OpenSSH version in […]
This article has been indexed from Check Point Blog
Read the original article: