OpenSSH 'SSHole' Flaw Hit by Real Attacks Within 9 Hours

Attackers exploited an authentication bypass in OpenSSH tracked as CVE-2026-123158 and nicknamed "SSHole" within 9 hours of its public disclosure, logging into servers without valid passwords or SSH keys, according to dailysecu.com. Threat intelligence firm Previdiian said on November 6 that it had observed real attack attempts targeting the vulnerability.

The first attack came within 9 hours of disclosure, and 8 attempts originated from IP address 89.116.89[.]18, located in Japan. The attackers bypassed authentication by entering abnormally long passwords, then ran commands such as id, uname and hostname to collect user privilege and operating system information.

Previdiian confirmed that the attacker obtained actual root privileges on an Alpine Linux-based honeypot. The successful intrusion was seen only in the company's honeypot; no compromise of real corporate servers and no additional malware installation were confirmed.

Which systems are exposed

The flaw arises from the combination of OpenSSH's password verification process and the cryptographic handling of the musl C library, with CVSS severity rated 8.1. Affected environments are mainly OpenSSH servers that use musl with PAM authentication disabled, including some default Alpine Linux configurations. Standard glibc-based Linux distributions and environments using PAM authentication are not directly affected.

The OpenSSH project released OpenSSH 10.6p2 on November 5 to address the vulnerability, and Alpine Linux is providing patched packages. KISA issued a security update advisory on November 7 and urged affected systems to apply patches promptly.