DE — heise online

OpenSSH and Alpine Linux Warn of Niche but Serious Bug

SecurityNovember 5, 20262 min read

The OpenSSH team and Alpine Linux warn of a serious bug. It affects only rare setups: systems that use the musl C library and do not use PAM for password logins. On those systems, password login may be bypassed.

What happened

The OpenSSH team warned of a serious bug. It appears only in certain, fairly rare setups. Affected systems are Linux systems that use the musl C library and do not use PAM (Pluggable Authentication Modules) for password logins. On these systems, the password check can apparently be skipped, so attackers could get access without knowing the password. OpenSSH developer Damien Miller urged users of such systems to turn off password login right away, or to disable SSH completely for now. Alpine Linux is among the affected systems, and its developers published the same warning. The fix is OpenSSH version 10.6p2, released today.

Key facts

Fixed version: OpenSSH 10.6p2, released today
Affected version: OpenSSH 10.6p1 is still shipped by many other distributions and download servers
Alpine Linux already offers the update
The fix is to set PasswordAuthentication to no and restart sshd

Some background

SSH is a tool that lets people log in to a computer over a network and run commands on it. A login can use a password or an SSH key. PAM is a set of modules that handles login checks on Linux. The musl library is a small alternative to the standard C library used on some Linux systems, such as Alpine Linux.

Why it matters

This bug could let attackers into a server without the password. The OpenSSH team says the cause is not in OpenSSH itself, but they still released a new version quickly. They found the problem only yesterday, when a worker at the AI security company Wakefield reported it. The developers rushed because they fear that others could also find the bug soon, with help from AI. Such cases have happened several times recently. Users of affected systems should update fast and turn off password-based SSH logins until then. SSH keys are generally the safer choice.

What to watch

Whether other Linux distributions ship OpenSSH 10.6p2 soon
Whether attackers start exploiting the bug
Whether the cause is found outside OpenSSH

Glossary

OpenSSH: A free tool that lets people securely log in to and control computers over a network.
Alpine Linux: A small Linux system often used in servers and containers.
musl: A small C standard library that some Linux systems use for basic program functions.
PAM: Pluggable Authentication Modules: a Linux system that checks who is allowed to log in.
SSH keys: A pair of digital keys used to log in safely without typing a password.
Wakefield: An AI security company that reported this bug to the OpenSSH team.

Strengthening Cybersecurity at Medical Institutions: Long-Term Risks to Patient Care from Ransomware Attacks

Japan's Ministry of Health, Labour and Welfare plans to significantly strengthen cybersecurity at medical institutions next fiscal year, requesting 13.7 billion yen for the project in its FY2027 budget request, up from 100 million yen in the FY2026 initial budget. A ransomware attack can make electronic medical records unusable for long periods and disrupt patient care, and the ministry's survey found many hospitals have numerous external connection points that are hard to manage and lack cybersecurity specialists. The ministry will support consolidation of external connections, use of specialists listed by IPA, and initial response to incidents.

Securityheise onlineNov 5

Patch now! Attacks on Zyxel switches observed

Admins must install current security updates to stop ongoing attacks on Zyxel GS1900 switches, as attackers can otherwise access devices and copy credentials. The flaw (CVE-2026-107441, CVSS 8.8, rated "high") can be exploited without authentication from the local network via a crafted HTTP request, and patches are provided only for models still within their support period. Researchers at Binarly found that the exploit used against the earlier CVE-2026-7273 also worked on the firmware meant to fix it, and the Canadian Cyber Centre has also warned of exploitation.

SecurityVnExpressNov 5

Hackers attack refrigeration systems at France's blood bank

Hackers targeted a refrigeration equipment supplier, raising storage temperatures at France's national blood agency (EFS) from -30°C to 110°C in three facilities in Bourgogne-Franche-Comté. A night-shift staff member noticed the abnormal rise and technical staff acted before any blood samples or products were damaged. EFS moved its products to other storage sites and is working with France's cybersecurity agency and the Ministry of Health on the investigation.

SecurityITmediaNov 5

Mos Burger, Workman, IIJmio Among Firms Announcing Customer Data Leaks from Unauthorized Access to Ararа

Companies using mail delivery service provider Arara are announcing customer data leaks linked to unauthorized access to the service. Mos Food Services (Mos Burger), Workman, IIJ, and Sumitomo Fudosan were among those announcing on November 4, with Arara estimating up to about 380 contracted companies may be affected. Mos Food Services reported that 7,517,087 records of its member data, including email addresses, were leaked, without payment card information.