OpenSSH has shipped an emergency release, version 10.6p2, to stop a password bypass that lets a remote attacker log in to accounts that have no password set. The flaw, tracked as CVE-2026-123158 and nicknamed “sshole,” affects Linux systems that run OpenSSH on the musl C library with PAM disabled. That combination is the default openssh-server package on Alpine Linux.
sshole: OpenSSH Fixes Password Bypass on Alpine Linux
About this summary. This is a short excerpt from the description that SOCRadar published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://socradar.io/blog/sshole-openssh-password-bypass-alpine/
Source attribution: headline and facts are from SOCRadar (socradar.io). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into…
Virtualization security: attack layers and misconfiguration impact
Introduction Incidents in virtual environments can begin with a software vulnerability, human error, a configuration weakness, or several of these factors at once. The…
NCSC-2026-0469 [1.00] [M/H] Kwetsbaarheid verholpen in OpenSSH door OpenSSH Project
Het OpenSSH project heeft een kwetsbaarheid verholpen in sshd van OpenSSH versies ouder dan 10.6p2. De kwetsbaarheid treft Linux systemen die gebruikmaken van musl libc…
OpenSSH flaw lets attackers log into password-disabled Linux accounts
A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to…
AI Agents Got Root on Linux via 948 Kernel Flaws in OpenAI Research
An unreleased OpenAI cyber model found and exploited 948 distinct Linux kernel privilege escalation bugs for about $1.2 million.
OpenAI debuts GPT-6 Cyber, touting better performance — and safety guardrails
OpenAI announced a new cybersecurity-focused model Thursday, citing internal benchmark testing that shows improvements in vulnerability discovery, patch development and…