#vulnerability

OpenSSH 10.6p2, released Nov. 5, fixes a flaw in which crypt\(3\)&\x27;s treatment of special password-hash values as in-band signals let 257- to 1,024-byte passwords bypass SSH authentication on Alpine Linux, potentially logging an attacker into passwordless key-based accounts if they already have network access and a valid account name. Alpine has published fixed packages for 3.16 and newer, and administrators who cannot upgrade immediately can set PasswordAuthentication no to disable password logins. No exploitation has been reported.

A CVE record, CVE-2026-83844, describes a remote code execution vulnerability in MS Paint, the long-standing Windows drawing app. The record&\x27;s wording, quoted in the discussion, states that "an unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network" — phrasing that implies a network-reachable service rather than a purely local file-parsing bug. The supplied record carries no CVSS score, no listed affected versions or platforms, and no explicit statement about whether exploitation requires user interaction, so the practical severity remains unclear from the available material. In the comments, one user reported that Windows Update did not offer a fix and that the patched version had to be obtained from the Microsoft Store, a claim not independently verified here.