OpenSSH released portable version 10.6p2 on November 5, 2026 to prevent a login bypass on some Linux configurations using musl without PAM. Alpine has shipped patched packages. Small teams administering applications over SSH should identify exposed hosts and confirm that the running process has actually received the fix.
Check the combination of settings
Alpine lists password authentication enabled, an account with an asterisk in its password field, and another local account with a SHA-256 or SHA-512 password hash among the requirements. Under these conditions, access may be possible without knowing a password. This does not mean that every Linux installation or Alpine container is vulnerable.
Your SSH key does not describe the server
An administrator may always use a key while sshd still offers password authentication to other accounts. What matters is the effective server configuration. BleepingComputer explains the difference between an account without a password and a service that refuses password logins; The Hacker News examines the musl scope. Check Point’s published tests add that the other account used in the process must be active.
Update while preserving a working connection
Follow Alpine’s advisory for the installed branch, then restart sshd. Distribution packages can contain the fix without carrying the upstream 10.6p2 version number, so compare the full package version with the official list. If you temporarily disable password authentication, retain a maintenance session and first test a fresh authorised key login. Do not close your only working connection before completing that check.
Review login records as well
Alpine recommends reviewing accepted password logins for accounts that should not have passwords, doas activity, and changes to accounts or authorised keys. Keep two conclusions separate: the host is patched, and no intrusion has been identified. The first does not establish the second. If access remains uncertain, have the host examined before introducing replacement secrets.
The link with Soclyde
A small business using Alpine still needs to organise hosting-console and recovery passwords even when SSH uses keys. Soclyde keeps those credentials in an encrypted vault on the user’s devices. It does not patch sshd or inspect logins. Where an intrusion is confirmed, access replacement must take place in the affected services.
Takeaway
Inventory Alpine hosts running sshd, inspect their configuration and retain evidence of the package update and daemon restart. Our password incident guide can help organise the account work that follows an incident.
