Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

Key Points:

• A critical OpenSSH vulnerability (CVE-2026-123158, "SSHole") allows attackers to access accounts without passwords on Linux systems using musl C library with PAM disabled, notably affecting Alpine Linux's default OpenSSH setup.
• The flaw stems from a 2016 patch and enables unauthenticated attackers to bypass password checks by sending oversized passwords, leading to successful logins on accounts with an asterisk (*) as their password hash.
• Exploitation grants access with the compromised account's existing permissions, potentially exposing deployment credentials, application secrets, and enabling lateral movement or service disruption in enterprise environments.
• Threat intelligence firm Previdian detected exploitation attempts within nine hours of vulnerability disclosure, confirming root access on a honeypot and observing multiple attacks originating from an IP in Japan.
• Users are urged to update to OpenSSH 10.6p2 or patched packages, restart sshd, and audit logs for suspicious password acceptance on accounts that should not permit password logins, with Alpine recommending treating machines as compromised if unauthorized access cannot be ruled out.