An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 on November 5. “An attacker who can reach your SSH port can log in without knowing any password.
OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
About this summary. This is a short excerpt from the description that Help Net Security published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/
Source attribution: headline and facts are from Help Net Security (helpnetsecurity.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
sshole: OpenSSH Fixes Password Bypass on Alpine Linux
OpenSSH has shipped an emergency release, version 10.6p2, to stop a password bypass that lets a remote attacker log in to accounts that have no password set. The flaw…
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into…
Any long password will do: SSH flaw lets hackers into Alpine systems, routers and more
Ernestas Naprys reports: A massive decade-old flaw affects Alpine and other distributions that run OpenSSH on the musl library. Containers, routers, IoT devices, and…
OpenAI Rates GPT-6 Cyber Critical After Major Vulnerability Discoveries
OpenAI GPT-6 Cyber found 81 high-severity Firefox flaws and hundreds of Linux bugs, raising new questions about AI-powered cyber risks. OpenAI has introduced GPT-6…
OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
On Linux distributions using musl libc without PAM, some accounts accept any password between 257 and 1024 characters.
Virtualization security: attack layers and misconfiguration impact
Introduction Incidents in virtual environments can begin with a software vulnerability, human error, a configuration weakness, or several of these factors at once. The…