GoKawiilAttackers exploit OpenSSH 'SSHole' flaw on musl-based Linux within days of patch
Security researchers say hackers began actively exploiting CVE-2026-123158, dubbed SSHole, which lets attackers bypass OpenSSH authentication on musl-based Linux systems like Alpine by sending oversized passwords that trigger a hashing error. OpenSSH patched the bug in version 10.6p2 on November 5, but a proof-of-concept appeared hours later, and GreyNoise recorded the first confirmed successful in-the-wild exploitation on November 7, with 16 exploitation chains from six IP addresses performing system reconnaissance.
GoKawiil's interpretation of the reporting above, not reported fact.
The rapid gap between patch release and active exploitation underscores how quickly attackers can weaponize disclosed vulnerabilities, leaving unpatched cloud and container deployments exposed. Because Alpine Linux is widely used in lightweight cloud and virtual environments, successful exploitation could grant root access on systems with passwordless admin accounts, according to researcher Ozgun Kultekin, making prompt patching especially urgent for operators of such infrastructure.
- SSHole (CVE-2026-123158) exploits a musl library quirk to bypass OpenSSH authentication on systems like Alpine Linux.
- OpenSSH's November 5 patch was followed within hours by public exploit code, and real-world attacks began within about 40 hours.
- GreyNoise observed limited but confirmed exploitation involving reconnaissance activity, while Defused reported only a small number of active attackers so far.
Source: bleepingcomputer.com, 2026-11-09
Published there as: “Hackers exploit SSHole OpenSSH flaw to breach Linux systems”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.