Daily brief: the last 24 hours

• 15 posts from 12 independent sources in 48 h
• OpenSSH: very widely used in large enterprises
• auth bypass / access control
• public exploit code
• Cloudflare Zero Wire: needs attention

• Cloudflare Zero Wire marks it "Needs attention"
• part of a breaking story: OpenBSD OpenSSH: Auth bypass / access control (2 CVEs)
• public exploit code exists

sshd in OpenSSH before 10.6p2 on Linux has a password authentication bypass when it is built with musl libc and without PAM. The server misreads whether a stored string is a password hash, so for some account configurations any password between 256 and 1024 characters is accepted. An attacker over the network gets logged in without knowing the real password. Exploitation in the wild is not established in the sources Watch Floor tracks (CISA KEV, vendor and CERT advisories), but 1 GitHub proof of concept exists, and exploit code is not proof of attacks. Cloudflare Zero Wire marks it "Needs attention" and a Synology advisory (Synology-SA-26:16) covers it. (AI summary · claude-sonnet-5-5)

1. Find every OpenSSH instance and its running version against the affected versions, internet-facing first.
2. Apply the vendor's fix (fixed in 10.6p2), including backported packages from your OS or hosting provider.
3. Check embedded copies: Synology published advisories for their own products.