The vulnerability allows any password between 257 and 1024 characters to be accepted for accounts with a password field set to an asterisk in the shadow file. This primarily impacts accounts intended to be locked, such as certain LDAP-mapped profiles and Alpine cloud root logins. Systems running glibc, configurations utilizing PAM, OpenBSD, and Dropbear SSH servers remain completely unaffected. OpenSSH rolled out a workaround in version 10.6p2 alongside backported fixes issued by Alpine.
Key points
Deployments using glibc or configured with PAM enabled are safe from this authentication…: Deployments using glibc or configured with PAM enabled are safe from this authentication bypass.
Alpine has backported essential security patches to both active branches and several end-…: Alpine has backported essential security patches to both active branches and several end-of-life releases.
Systems that rely strictly on the Dropbear SSH server are completely unaffected by this v…: Systems that rely strictly on the Dropbear SSH server are completely unaffected by this vulnerability.
Sources checked by our analysis pipeline: 1
OpenSSH built against musl libc and running without PAM accepts any password between 257 and 1024 characters for accounts whose password field in /etc/shadow is exactly *. The accounts affected are those intentionally locked or configured for key-only authentication, including root on many Alpine cloud images, deploy users, and certain LDAP-mapped accounts.
The condition is present only on musl-based systems that do not use PAM for password verification. glibc systems, systems with UsePAM yes, Dropbear, and OpenBSD are unaffected. OpenSSH 10.6p2, released 5 November 2026, contains a workaround. Alpine has backported the fix across supported and several EOL branches.
Originally spun out from Uber's acquisition of Postmates, the publicly traded robotics company is commercially releasing its proprietary data tools and connectivity architecture to external developers. This strategic pivot mirrors Amazon's cloud infrastructure strategy, enabling third parties to offload heavy onboard computing and improve how automated machines operate in complex human environments.
Autonomous mobility operations are slated for a regional capacity boost as service coverage scales up for local passengers. The fleet adjustments will enhance ride-hailing availability across the metropolitan area through targeted partner integration. This timeline reflects ongoing efforts to meet projected operational targets by the close of the calendar year.
Developers can now orchestrate one-time or recurring tasks across production, preview, and custom environments as Vercel introduces its successor to traditional Cron Jobs. The updated tool provides deeper integration with backend architectures by targeting private functions, HTTP paths, and queue topics directly. It also enables teams to manage or trigger executions on demand without having to initiate project redeployments.