Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH

Attackers are now actively abusing SSHole, a high-severity OpenSSH authentication bypass tracked as CVE-2026-123158, just days after patches were released. The bug stems from how sshd handles password hashing on musl libc systems without PAM — such as Alpine, Buildroot, OpenWrt, and Yocto — letting an attacker log into unprotected accounts like root using any password between 257 and 1024 characters long, due to a quirk in musl's crypt() function that falsely returns a matching hash value. Security firms WatchTowr, Previdian, GreyNoise, and Defused have all reported real-world exploitation attempts, with Previdian logging 20 attempts from 13 attacker IPs across 9 countries since November 6, currently linked mainly to botnets and crypto-mining operations. Admins are urged to upgrade to OpenSSH 10.6p2 immediately, or disable password authentication or SSH altogether, and review logs for signs of compromise.