Attackers target Linux systems using newly patched SSHole vulnerability in OpenSSH

Cybersecurity firms warn that hackers are actively exploiting an OpenSSH vulnerability designated CVE-2026-123158, dubbed SSHole, to access Linux systems. Disclosed by researcher Ozgun Kultekin, the flaw allows attackers to bypass authentication on certain musl-based distributions, including Alpine Linux. OpenSSH maintainers released a patch in version 10.6p2 on November 5, but public exploit code appeared roughly four hours later, with successful breaches confirmed beginning the following day. [1]

The bug arises when an account has its password hash set to an asterisk to prevent password logins. An oversized password causes the musl hashing function to return an asterisk on error, which OpenSSH mistakes for a valid match. The flaw does not impact accounts with valid password hashes. While exploitation requires specific authentication configurations, it can grant root access if the compromised account possesses administrative privileges. [1]

Threat actors are using the flaw to steal credentials, run cloud reconnaissance, and install backdoors such as the Python-based TAC Agent. Security firm watchTower linked early attempts on November 6 to botnets and cryptocurrency mining activity, and SecurityWeek notes that other threat actors are anticipated to follow. Administrators are urged to update OpenSSH immediately or turn off SSH password authentication. [1][2]