Critical OpenSSH bug lands as AI exposes old code

OpenSSH 10.6p2 came out with a workaround for a critical vulnerability, and three front-page items track it: the release thread, a separate Alpine-without-PAM note, and a writeup called Sshole that commenters pointed to as the good explanation. The early thread advice was practical. The affected setup was described as musl-based, the quick fix was PasswordAuthentication=no, and people immediately asked whether Dropbear and musl-based OpenWrt routers were exposed. One commenter joked that people running lightweight containers just had a heart attack.

An adjacent thread, "AI is forcing us to pay off 40 years of technical debt," gives the bigger frame. Commenters said better sooner than later, and hoped AI-driven auditing is accidentally surfacing backdoors and zero-days held by nation states and spyware vendors like Pegasus. One person is going the opposite direction, using AI to write tiny purpose-built microkernels and servers so there is less code to be vulnerable in the first place. Add "A thousand fewer paths to root" and the news that residential proxies were detected on the White House network, and the day reads as a security-heavy one.

The pattern here: cheap AI code review is making old, boring infrastructure get audited for the first time in decades. The bugs were always there. Finding them just got cheap.