Hackers exploit SSHole OpenSSH flaw to breach Linux systems

A newly disclosed OpenSSH authentication bypass dubbed "SSHole" (CVE-2026-123158) is now being actively exploited to gain unauthorized access to Linux servers, according to multiple security firms. The bug affects OpenSSH on musl-based distributions such as Alpine, where an overly long password triggers musl's hashing routine to return an asterisk on error — a value OpenSSH wrongly accepts as a match for accounts whose password field is deliberately set to "*" to block password logins. Researchers Defused, GreyNoise and Previdian have all logged real-world exploitation chains following public release of a PoC on November 5, with GreyNoise documenting root compromises, cloud metadata queries, SSH key tampering, and deployment of a Python-based backdoor called TAC Agent believed to be operated by Chinese-speaking actors. WatchTower separately tied exploitation to botnet and cryptomining campaigns. Administrators are urged to upgrade to OpenSSH 10.6p2 or disable password authentication, and to audit systems for rogue SSH keys, unexpected logins, or TAC Agent artifacts.