Hackers exploit OpenSSH flaw to breach Linux systems

OpenSSH has a newly disclosed security flaw that anyone running it should know about.

This requires local or already-authenticated access to reach.

Hackers are actively exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.

Multiple cybersecurity firms have confirmed the attacks, reporting that exploitation attempts began on November 5, the day a proof-of-concept exploit became available, with successful exploitation recorded the following day.

Disclosed by security researcher Ozgun Kultekin last week, SSHole allows bypassing authentication in OpenSSH running on certain musl-based Linux systems, including the lightweight Alpine distribution used in cloud and virtual environments.

OpenSSH maintainers fixed the vulnerability in version 10.6p2 released on November 5, while exploit code became available roughly four hours later.

Anyone running OpenSSH 10.6 is exposed, specifically wherever OpenSSH is actually deployed rather than just licensed or installed somewhere unused.

The flaw lets attackers log in to accounts with a password hash is set to an asterisk (*) to prevent password logins.

An oversized password causes musl’s password-hashing function to return * on error, which OpenSSH mistakenly treats as a match for the account’s stored value.

What an attacker actually gains: successful exploitation allows the attacker to execute code with the permissions of the affected process.

Kultekin explained that exploitation requires specific authentication settings, does not affect accounts with valid password hashes, and can lead to root access where the compromised account has passwordless administrative privileges.

In the attacks that GreyNoise observed, the threat actor ran system and container reconnaissance, initiated queries to cloud metadata services, attempted to read password hashes and root SSH keys, and tried to modify SSH ‘authorized_keys’ files to gain persistent access.

This is tracked as CVE-2026-123158 -- use that identifier when checking vendor guidance or scanner results.

The affected versions are 10.6, so that's the range to check against your own deployment.

Finnish security company Defused said over the weekend that it had observed a small amount of actors trying to exploit SSHole, although the activity was not widespread.

Threat intelligence company GreyNoise recorded the first successful exploitation of SSHole in the wild on November 7 at 00:46 UTC, about 40 hours after the fix.

Analysis of the TAC Agent payload shows that the implant supports shell command execution, extensive system reconnaissance, file upload/download operations, and can update itself.

A finding that suggests possible automated operation is a missing tool check that returns feedback which could help an automated planner revise commands as needed for the attack to proceed.

Confirm whether OpenSSH 10.6 is present anywhere in your asset and software inventory.

No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.

System administrators should update OpenSSH as soon as possible, or disable SSH password authentication on systems affected by SSHole.