Alpine Linux Patches OpenSSH Password Bypass

This is a sharp reminder that minimal Linux environments can turn obscure libc behavior into remotely exploitable authentication failures.

• –Exploitation requires musl libc, disabled PAM, enabled password authentication, and specific shadow-account combinations.
• –Attackers can use an unusually long password to access accounts that should reject password login.
• –Alpine backported the fix as far back as version 3.16, signaling broad deployment risk.
• –Operators must restart `sshd` after upgrading; updating the package alone leaves the vulnerable daemon running.
• –Key-based authentication and `PasswordAuthentication no` remain the safer baseline for Alpine servers.