OpenSSH patches critical sshole flaw affecting Alpine Linux

OpenSSH has issued version 10.6p2 to close a critical vulnerability that lets attackers log into password‑less accounts on Alpine Linux and other musl‑based systems. The flaw, named sshole, exploits an OpenSSH patch from 2016 that hashes passwords even when no usable hash exists, and musl’s crypt() returns an asterisk for oversized passwords. Researchers say the bug has existed since 2016 and affects configurations where password authentication is blocked but the account remains active. No exploitation reports exist, and users are advised to disable PasswordAuthentication immediately.