For those that are saying u can still login with 8 correct password + xyzzzzzzz

The reason for that is probably
1) you urself didnt change the original 8 characters password.
2) the system still need to provide backward compatibility to users who didn't change to a longer password, maybe their implementation is poor, if fail to match full length password, then match 1st eight type of code...
3) in term of the 8 characters password being a problem in the 1st place.... That shouldn't b.. passwords even with 8 characters shld be sufficiently strong if you have it at least randomized, they shld implement blocking of subsequent tries after failure of the first 10 attempts.

Whatever is happening, its more than just a password issue i believe.