GoKawiilAttackers exploit OpenSSH 'SSHole' flaw on musl-based Linux within days of patch
Security researchers say hackers began actively exploiting CVE-2026-123158, dubbed SSHole, which lets attackers bypass OpenSSH authentication on musl-based Linux systems like Alpine by sending oversized passwords that trigger a hashing error. OpenSSH patched the bug in version 10.6p2 on November 5, but a proof-of-concept appeared hours later, and GreyNoise recorded the first confirmed successful in-the-wild exploitation on November 7, with 16 exploitation chains from six IP addresses performing system reconnaissance.