OpenSSH 10.6p2 Patches musl libc PAM Bypass Allowing Single-Packet '*' Account Logins

The root cause is a string/hash misinterpretation in the authentication path when sshd calls into musl's crypt implementation on systems that mark key-only accounts with '*'. An attacker needs only the target username plus the existence of one local account using $5$ or $6$ hashes; no password knowledge or retries are required. Alpine confirmed the condition exists from 3.16 onward and published an immediate update advisory.

Procurement and distribution records show Alpine, Buildroot and Yocto are standard in embedded and cloud images; Shodan data already lists 22 million exposed SSH endpoints, a subset of which match the musl non-PAM profile. OpenSSH developer Miller explicitly cited AI-driven rediscovery risk as justification for collapsing the embargo, a departure from prior multi-week practices.

The pattern matches earlier rapid-rediscovery events where public details triggered scanning within hours. Operators running password authentication on affected stacks must either patch and restart sshd or disable password methods; monitoring for single-connection successes to '*' accounts is now a required detection rule.

Next steps include mass scanning by commodity brute-forcers by weekend and downstream image rebuilds in embedded supply chains within seven days.