From hacked French refrigerators igniting fires to a massive OpenSSH authentication bug hiding in plain sight for a decade, this week’s stories expose how lapses in basic

Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]

Hackers exploit SSHole OpenSSH flaw to bypass Linux logins and install a Python backdoor. CISA confirms exploits as patched packages become available.

CISA adds four exploited flaws to KEV as OpenSSH SSHole attacks involve TAC Agent deployment, credential access attempts, and botnet activity.

From hacked French refrigerators igniting fires to a massive OpenSSH authentication bug hiding in plain sight for a decade, this week’s stories expose how lapses in basic

It's a bad one, and it's been in the code for a decade: A newly disclosed flaw involving OpenSSH and musl, dubbed "*sshole," allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts configured to block password authentication simply by entering an oversized password. "Oversized" means longer than 256 bytes. Details. Slashdot thread. And another news article.

sshole" poses a serious threat to Internet security.

CISA warned of active exploitation of SSHole an OpenSSH flaw allowing passwordless access to certain Linux accounts.

Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.

CISA adds four exploited flaws to KEV as OpenSSH SSHole attacks involve TAC Agent deployment, credential access attempts, and botnet activity.

A newly disclosed OpenSSH vulnerability dubbed "*sshole" allows attackers to log in to certain Alpine Linux and other musl-based Linux accounts that are configured to block password authentication,…

openssh on musl linux has been letting people into password-less accounts since 2016.

Security Now breaks down the alarming new SSH authentication flaw, its rapid exploitation, and exactly how AI-powered tools are transforming cybersecurity.

Eine seit 2016 bestehende OpenSSH-Lücke erlaubt die Anmeldung an gesperrten Konten auch auf musl-basierten Linux-Systemen. Ein Sicherheitsupdate ist verfügbar.

Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access.

OpenSSH 10.6p2 fixes a critical password authentication bypass affecting certain Linux systems and includes several additional bug fixes.

CISA lists the OpenSSH password bypass CVE-2026-123158 as exploited. See which Linux servers are in scope and how to update to OpenSSH 10.6p2.

CISA has flagged active exploitation of SSHole, an OpenSSH authentication bypass (CVE-2026-123158) that lets remote attackers access certain Linux accounts without a valid password or SSH key. The OpenSSH flaw affects specific server configurations, carries a CVSS score of 8.1, and was added to CISA’s KEV catalog on November 9, 2026, with a November 12 remediation deadline. The entry requires forensic triage under Binding Operational Directive 26-04 and lists ransomware use as unknown. Organizations should assess exposed systems and follow vendor guidance. SSHole affects OpenSSH on Linux when the server uses musl libc, a system software library, and checks passwords without PAM, the Linux authentication framework. Alpine Linux is one affected platform. OpenSSH versions before 10.6p2 need the upstream fix or a patched distribution package. As explained in Cybersecurity News’s earlier OpenSSH analysis , several conditions must exist together. Password authentication must be enabled, the target account’s stored password field must contain *, and another local account must hold a valid SHA-crypt password hash. Simply running an Alpine container does not establish exposure. The failure occurs when musl’s crypt() function receives an overly long password. For the affected hashing path, input exceeding 256 bytes can make the function return * as an error marker. OpenSSH may compare that marker with the target account’s stored * and accept the login. The documented trigger range is 257 to 1,024 bytes. Active Exploitation of OpenSSH SSHole Flaw Accounts with valid password hashes are not bypassed through this mechanism. The risk concerns accounts whose password fields contain the matching marker, even when administrators intended those accounts to use SSH keys. The official CVE record identifies the underlying problem as a password hash interpretation error. The supplied SANS Internet Storm Center findings describe deliberate attempts using passwords filled with repeated “A” characters. Researcher Johannes Ullrich recorded 232 long-password requests on November 5 and 713 on November 6. These totals represent suspicious requests, not confirmed breaches or separate attackers. Cowrie honeypots record only the first 255 password characters, limiting analysis of longer inputs. Ullrich suspected some logins succeeded, but the supplied account does not confirm successful sessions. CISA’s listing provides the broader exploitation warning. Administrators should install patched packages and restart sshd. OpenSSH 10.6p2 contains the upstream workaround, while distribution fixes may keep older version banners. Where updates must wait, setting PasswordAuthentication no blocks this path; confirm working key access before changing settings. Investigation should cover successful password logins to accounts without usable passwords, unexpected privilege changes, and newly added authorized keys. Earlier SSH honeypot research shows why monitoring must include non-interactive commands after login. Updating closes the flaw, but teams must also check whether attackers already used the affected account to run commands, change files, or establish continued access before the fix was applied. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post CISA Confirms Hackers are Exploiting SSHole, the OpenSSH Vulnerability appeared first on Cyber Security News .

Die US-amerikanische IT-Sicherheitsbehörde CISA warnt vor Angriffen auf GPUStack, FreeSwitch, OpenSSH und IBM Aspera Faspex.

Am 5. November 2026 hat das OpenSSH-Projekt mit OpenSSH 10.6p2 eine sicherheitsrelevante Korrektur für einen Authentifizierungs-Bypass veröffentlicht. Die Schwachstelle ermöglicht unter bestimmten Voraussetzungen eine Umgehung der SSH-Passwortauthentifizierung. Ein Angreifer kann sich dabei durch...