It’s not a quick or easy fix. The patch is a 10000 line nightmare. No really it’s actually 10k. A lot of that is test code, but there are also significant changes to deep engine internals.
PHP did really really bad memory limit handling. Now it’s only really bad.
Correct, password authentication must be enabled on the SSH daemon side of things to be vulnerable. The user account being logged into, on the other hand, can’t have a password set. But overall, PW auth must be on. The website OP linked is exceedingly bad at explaining the actual problem, see Alpine’s announcement for better info.
https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/