The Whistle: Special Bulletin - OpenSSH password bypass (CVE-2026-123158) on musl systems
OpenSSH shipped an emergency release one day after learning of the bug, with Damien Miller telling musl-libc operators to disable password auth IMMEDIATELY. CVE-2026-123158 at CVSS 8.1 lets an attacker log into any passwordless account with a single sent password, first connection, every time. glibc distributions and PAM-using systems are not affected, which is why your Ubuntu fleet is safe. Your Alpine containers with an sshd inside are another matter.