#security

OpenSSH 10.6p2, released Nov. 5, fixes a flaw in which crypt\(3\)&\x27;s treatment of special password-hash values as in-band signals let 257- to 1,024-byte passwords bypass SSH authentication on Alpine Linux, potentially logging an attacker into passwordless key-based accounts if they already have network access and a valid account name. Alpine has published fixed packages for 3.16 and newer, and administrators who cannot upgrade immediately can set PasswordAuthentication no to disable password logins. No exploitation has been reported.

A GitHub issue filed against postmanlabs/postman-app-support \(\14370\) alleges that Postman silently installs AI plugins and transmits API request data to its own servers, including the resolved values of templated variables such as \\{\{some\secret\}\}\ used in query parameters. Commenters in the associated Hacker News thread \(roughly 993 points and 329 comments\) report that blocking traffic to the logging endpoint breaks the application, and that the tool does not meet HIPAA requirements. The claims come from the issue and community discussion and were not independently verified in the supplied material, and Postman has not responded in the available evidence. Some developers say they have already moved to the Git-friendly alternative Bruno as a result.

A CVE record, CVE-2026-83844, describes a remote code execution vulnerability in MS Paint, the long-standing Windows drawing app. The record&\x27;s wording, quoted in the discussion, states that "an unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network" — phrasing that implies a network-reachable service rather than a purely local file-parsing bug. The supplied record carries no CVSS score, no listed affected versions or platforms, and no explicit statement about whether exploitation requires user interaction, so the practical severity remains unclear from the available material. In the comments, one user reported that Windows Update did not offer a fix and that the patched version had to be obtained from the Microsoft Store, a claim not independently verified here.