An update to my *sshole post and the how-to.
What’s new
OpenSSH has shipped emergency fixes in 10.6p2 for CVE-2026-123158 (CVSS 8.1), SecurityWeek reports. The issue affects sshd on musl-based Linux (Alpine, OpenWrt, Buildroot, Yocto and similar) when PAM is disabled. Damien Miller said they’re shipping fast because AI agents have been rediscovering bugs within hours, so long embargoes mostly help attackers.
Alpine told users to apply the OpenSSH patches and restart sshd, or disable password logins and restart sshd.
What to do
- Upgrade OpenSSH to 10.6p2 (or your distro’s patched package) and restart sshd so the running daemon is replaced
- Prefer key-only logins; disable password authentication where you can
- Use the how-to above to check whether you’re on a musl stack
My take
If you run Alpine or another musl distro with sshd exposed, patch today. Don’t wait.
God Bless, and Happy hacking!
