Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

Security firm Previdian reports that attackers began probing a newly patched OpenSSH flaw just hours after it became public, and managed to gain root access on one of its honeypots. The bug, CVE-2026-123158 (CVSS 8.1), dubbed SSHole, affects Linux systems running OpenSSH built against musl libc with PAM disabled — notably Alpine Linux's default sshd setup. By submitting an oversized password (257–1,024 bytes), an unauthenticated attacker can trigger a hashing failure that mimics the special "*" marker used for accounts with no usable password, letting them log into such accounts without any credentials; accounts with real password hashes remain unaffected. Previdian recorded eight exploitation attempts from a Japan-based IP within nine hours of disclosure, running recon commands like id, uname, and hostname over SSH. Administrators should upgrade to OpenSSH 10.6p2 (or their distro's patched build), restart sshd, and audit logs for suspicious "Accepted password for" entries tied to key-only or no-password accounts.