Summary

An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 on November 5. “An attacker who can reach your SSH port can log in without knowing any password. It…

For more information, read the full story at the original source: Help Net Security ↗

Vulnerabilities in this story

• CVE-2026-123158 KEV · fix by 2026-11-12 OpenBSD OpenSSH EPSS 1% 8.1High
• CVE-2016-6210 EPSS 88.9% 5.9Medium

Also reported by

• SecurityWeek: Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH ↗
• BleepingComputer: Hackers exploit SSHole OpenSSH flaw to breach Linux systems ↗
• ZDNet How-to: Alpine Linux and OpenSSH patch flaw that’s as bad as it can get ↗
• The Hacker News: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot ↗