If you run Alpine-based containers or a bastion host, an account with no password set is not a locked account this week.
The Hacker News reports OpenSSH shipped an emergency fix for a flaw where attackers can log in to accounts that have no password, like SSH key-only accounts, on some Alpine Linux servers running the standard openssh-server package. All it takes is network access to the server and an account name. Separately, Tom's Hardware reports a PHP vulnerability post-mortem showing the bug was known to a small team of maintainers two years before it was made public, while a new chained exploit called PHP2Shell is hitting servers.
Both stories land in the same place: what failed was not application logic but the auth layer underneath it, and the clock on when you got told. Key-only SSH accounts are a control I have relied on for years in production. A password path nobody configured is exactly the kind of assumption that never shows up in a code review.
I do security review of payment and account flows, including what the base image and the access path actually permit rather than what the config intends. A focused review takes days, not months, and you get cost and timeline within a day.
If your payment or account service sits behind an Alpine image or a shared bastion, message me and I will tell you what I would check first.