Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

Live updates

1. 52m ago

   OpenSSH SSHole Vulnerability Under Active Exploitation

   Threat actors are actively exploiting a high-severity authentication bypass vulnerability in OpenSSH tracked as CVE-2026-123158 and codenamed SSHole or *sshole. The flaw carries a CVSS score of 8.1 and impacts Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules disabled, such as the default OpenSSH server configuration on Alpine Linux. Unauthenticated attackers can supply passwords exceeding 256 characters to gain unauthorized access to accounts configured without usable passwords. Emergency fixes have been released by OpenSSH and musl-libc for millions of systems.

   Why it matters

   The security community disclosed this ten-year-old flaw after discovering that combined issues in OpenSSH and musl-libc allowed anyone to bypass authentication by typing overly long passwords. Security researcher Ozgun Kultekin discovered the vulnerability, which effectively turns disabled passwords into unauthorized access points without requiring stolen credentials or SSH keys. Emergency patches including OpenSSH version 10.6p2 are available, and administrators are urged to patch immediately.

   What is confirmed

   • CVE-2026-123158, codenamed SSHole or *sshole, is an OpenSSH authentication bypass vulnerability affecting musl-libc systems.
   • The vulnerability carries a CVSS score of 8.1.
   • The issue impacts Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules disabled, including the default configuration of Alpine Linux.
   • An unauthenticated attacker can supply an oversized password exceeding 256 characters to access accounts configured without usable passwords.
   • Security researcher Ozgun Kultekin discovered the vulnerability, which has been addressed in OpenSSH 10.6p2.

   Still unconfirmed

   • Threat actors are attempting to exploit the flaw, according to Previdian.

   What to watch next

   • Widespread adoption and deployment of OpenSSH 10.6p2 and musl-libc emergency fixes by system administrators.
   • Further telemetry regarding the scale of active exploitation attempts against vulnerable Alpine Linux and other distribution setups.
   Sources used for this update (19)

   1. www.bluesnews.com — Blue's News - All the carnage that's fit to post!
   2. arstechnica.com — Ars Technica - Serving the Technologist since 1998. News, reviews, and ...
   3. thehackernews.com — The Hacker News | #1 Trusted Source for Cybersecurity News
   4. gigazine.net — Headline news for October 8, 2026 - GIGAZINE
   5. pcper.com — Tailworm, A List Of Tailscale SSH Server Vulnerabilities So Long It Gets A Chart
   6. Ars Technica — Meet *sshole, the vulnerability that lets hackers SSH into Linux devices
   7. The Hacker News — OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux
   8. OX Security — OpenSSH Password Authentication Bypass on Alpine Linux (*sshole) – CVE-2026-123158
   9. Tom's Hardware — Combined flaws let anyone into Alpine Linux and other distros by typing anything over 256 characters as a password — emergency fixes for OpenSSH and musl-libc issued for millions of systems, patch immediately
   10. The Register — Get root on a musl Linux system by slamming it with an overly long password
   11. arstechnica.com — Meet *sshole, the vulnerability that lets hackers SSH into ...
   12. www.antispier.com — Meet *sshole, the vulnerability that lets hackers SSH into ...
   confidence 100%