Alone with the bug

Stop reading. That is the instruction Damien Miller posted early Thursday with OpenSSH 10.6p2, for anyone running Linux on musl libc without PAM, Alpine being the familiar case. Stop reading, set PasswordAuthentication=no or turn SSH off, immediately. The OpenSSH team had learned of the critical bug the day before. They didn't sit on it, and Miller said why:

Coordinated disclosure rests on one assumption: for a while, the person who found the bug is the only one who has it. The embargo, often 90 days, is that assumption with a calendar attached. Keep quiet, fix it, then tell everyone, because telling everyone first hands out a map. Miller is saying the assumption no longer holds. The day's other two security stories show why, and they point at what has to replace it.

OpenAI published a report on Wednesday about a pipeline it ran against the Linux kernel in mid-October with an upcoming cyber model. It reproduced 1,724 vulnerabilities and wrote 948 working local privilege escalation exploits against a stock desktop distribution, for $1,213,430 in API credits. That is $1,279 per root exploit, against the $20,000 to $70,000 that Pwn2Own and TyphoonPWN have historically offered for one. The detail that matters for disclosure is smaller. While the scan ran, more than 100 Linux privilege escalations were patched or staged by other contributors within 10 days, with about 300 more under public discussion, and OpenAI now advises revalidating findings against the latest code to avoid duplicate reports. Duplicate reports. Of kernel root exploits. The finder isn't alone with the bug. The finder is in a queue.

IEEE Spectrum's account of PHP2Shell shows where the old protection came from. The underlying bug was reported to the PHP Foundation in 2024 as a crash, and there it sat, because crash reports rarely get taken seriously. What kept it safe all that time wasn't that nobody knew about it. It was the cost of turning a crash into code execution, which Columbia's Suman Jana describes as "a lot of very specific reasoning that is painful to do." A researcher at Calif, working with AI tools, did that reasoning in two weeks.

The embargo wasn't guarding a secret. It was guarding an expense. And that expense is falling for everyone at once, attackers included.

The embargo wasn't guarding a secret. It was guarding an expense.

The case for embargoes still has teeth. Publish a bug before the fix and you've told every attacker who reads release notes where to dig. PHP2Shell's patch took four engineers two months; announcing it on day one would have been a gift. That much is right. But Miller's choice wasn't secret versus public. It was who got the hours in between, defenders or attackers, and he could give them to defenders because OpenSSH had something to hand over: a config line that removes the attack surface while the root cause, which Miller places outside OpenSSH, gets fixed properly. The PHP fix took two months. The OpenSSH mitigation was one line of config. That gap isn't a matter of disclosure policy. It's whether the software has a setting that turns the vulnerable path off.

OpenAI's report says that within a few years, frontier models will likely find whatever vulnerabilities a project has, and even weaker models may build exploits once a bug is disclosed. Take that at face value and a maintainer's security question changes shape. It is no longer how long a bug can stay quiet. It's how fast users can be told what to turn off, and whether there is anything to turn off.

Miller could tell people to stop reading because there was a line to change. Most software has no such line. That is the feature worth writing next.