The OpenSSH flaw nicknamed SSHole (CVE-2026-123158, CVSS 8.1) is no longer just a lab result. Threat intelligence firm Previdian says its first observed exploitation attempt came less than nine hours after the CVE was published, and that it confirmed successful root access on a honeypot running real Alpine Linux and OpenSSH. The fix, OpenSSH 10.6p2, shipped on 5 November 2026.
What the attackers did: according to Help Net Security, the early attempts came from one IP address that Previdian linked to Japan. It sent oversized passwords to get past authentication, then ran id, uname and hostname in non-interactive SSH sessions. Previdian first counted eight attempts from that address, caught by one sensor. Its public CVE page, updated on 6 November, now lists attempts from 3 IP addresses in 3 countries (Switzerland, Japan and Singapore) seen by 2 sensors, with the first at 00:05 UTC; the page notes that an attempt does not by itself show whether a target was vulnerable. The counts differ between reports, so treat them as early figures. CISA had not added the flaw to its KEV catalog when Help Net Security published.
Who is exposed: OpenSSH before 10.6p2 on Linux systems that use musl libc and do not check passwords through PAM. Alpine Linux's default openssh-server fits this; the researcher, Özgün Kültekin, also flagged OpenWrt, Buildroot, Yocto and various Docker images. An attack needs password logins enabled (the OpenSSH default), an account whose password field is * (root, key-only deploy users, LDAP users, the default user on Alpine's AWS and Azure images) and another local account with a password hash. Such accounts then accept any password longer than 256 characters. Glibc systems such as Debian, Ubuntu and Fedora, setups using PAM, Dropbear and OpenBSD are not affected, the researcher says.
Why root matters: OpenSSH's default PermitRootLogin setting blocks direct root logins unless an admin changed it. The bigger risk, Help Net Security reports, is on Alpine's official AWS and Azure tiny-cloud images (3.18.11 to 3.24.3), where the default alpine user has passwordless doas, which gives root.
OpenSSH developer Damien Miller said the release was rushed because AI agents have been rediscovering bugs quickly. Public proof-of-concept exploits are on GitHub; Previdian warns they are unverified and could contain malware. You can check what your public servers expose with a free Watchpost scan.
