Attackers exploit the OpenSSH "sshole" flaw within hours of disclosure and get root on a honeypot
Threat intelligence firm Previdian says the first attempt came less than nine hours after the CVE was published.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
Attackers are already exploiting the OpenSSH flaw CVE-2026-123158, nicknamed sshole, which lets remote attackers log into password-disabled accounts on Alpine Linux and other musl-based systems. Help Net Security and The Hacker News both report the attacks. The bug was found by Wakefield researcher Özgün Kültekin and fixed in OpenSSH 10.6p2 on November 5. Alpine Linux's security advisory says an attacker who can reach the SSH port can log in without a password, with a single connection that works every time. Previdian founder Ryan Dewhurst told Help Net Security that the company's sensors recorded the first attempt less than nine hours after the CVE was published. He said one attack gained root access on a Previdian honeypot running real Alpine Linux and OpenSSH. The attacker used oversized passwords to get past authentication and then ran reconnaissance commands such as id, uname and hostname. Previdian has counted eight attempts so far, all from a single Japan-based address and all caught by one sensor. The company has added the flaw to its own list of known exploited vulnerabilities, but CISA had not yet added it to its catalog. Operators of Alpine, OpenWrt and embedded Linux systems that expose SSH should update, given how quickly exploitation followed disclosure.