OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability
1 comments
- Points176
- Comments220
–Rank now
#13Peak rank
2Days on list
58Score · 7d
Nov 5, 2026First seen
Rank · 7 days
On Hacker News
https://alpinelinux.org/posts/2026-11-05-openssh-password-au...
- Points
- 176
- Comments
- 220
- Submitted by
- Animux
- Posted
- Nov 5, 2026
- Site
- hachyderm.io
Story details from Hacker News ↗ · linked article on hachyderm.io.
Trending history
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability was first seen on Hacker News · Front page on Nov 5, 2026. Since then it has appeared in 21 checks on 2 different days. Its best position was #13 of 30, reached on Nov 5, 15:07 UTC. It dropped off the list after Nov 6, 04:07 UTC.
Rank history
Position on Hacker News · Front page at every check (lower is better).
Last 14 days
Best rank per day (UTC).
13
16
Oct 26today
Metric history
Platform metric as reported by Hacker News.
From the discussion
A few top-level comments from Hacker News, shortened. Read the full thread on Hacker News.
musl’s crypt() returns the string * as an error indicator when the key is over 256 bytes long. * is also exactly what the stored field contains for every account with no password, so the “hash” matches and the login succeeds. Does anyone know why musl does this? Are they the only C library that behaves this way? For…
Wow, what a bug. I expect the exploit is literally as simple as trying to ssh in as a user with the password has ‘*’ in /etc/shadow and typing anything as the password. To the extent that systems that are configured in the vulnerable manner exist in the wild, I’m surprised they weren’t exploited years ago by trivial…
> We are making this release as fast as possible (we learned of the problem yesterday) because we have recently observed multiple cases of rapid bug rediscovery by AI agents, sometimes within hours, and so now consider long embargo periods to be a dangerous practice that primarily benefits attackers. I think this…
Featured in
Archived daily, weekly and monthly lists that include this entry.
Hacker News 2 days, best #13
Questions
Is OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability trending on Hacker News right now?
Not at the moment. It was last on the list on Nov 6, 04:07 UTC, after 2 days of trending.
What is the highest rank OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability reached?
#13 on Hacker News · Front page, on Nov 5, 15:07 UTC. Trendoday checks this list every 15 minutes.
How long has OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability been trending?
It was first seen on Nov 5, 2026 and has been on the list on 2 days (21 checks) since.
How much discussion did it get on Hacker News?
176 points and 220 comments; submitted by Animux on Nov 5, 2026.