Hackers are actively exploiting a recently discovered critical vulnerability that allows them to log in to privileged accounts on many Linux systems, multiple researchers are reporting. The vulnerability, tracked under the name *sshole, arises from the interaction between OpenSSH and a code library known as musl.
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
About this summary. This is a short excerpt from the description that Ars Technica published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://arstechnica.com/security/2026/11/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under-active-exploitation/
Source attribution: headline and facts are from Ars Technica (arstechnica.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.
Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to…
OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)
An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm…
sshole: OpenSSH Fixes Password Bypass on Alpine Linux
OpenSSH has shipped an emergency release, version 10.6p2, to stop a password bypass that lets a remote attacker log in to accounts that have no password set. The flaw…
Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
Devices running some configurations of Alpine Linux, and possibly other distributions, are affected by a decade-old vulnerability that allows attackers to log into…
Attackers exploit critical Node-RED flaw to deploy Linux bot and backdoors (CVE-2026-58115)
Attackers are exploiting an authentication flaw (CVE-2026-58115) in Node-RED, a programming tool built into some industrial control products, to install a Linux bot and…