Back

Active Exploitation Reported for OpenSSH SSHole Flaw

lite News Desk 2 min read

The OpenSSH vulnerability known as SSHole, identified as CVE-2026-123158, is being actively exploited, according to security researchers whose observations were reported by Ars Technica on November 9, 2026. The reported attacks involve a flaw affecting Linux systems only under a particular combination of software, authentication settings and account configurations.

The affected configuration uses musl without PAM and must also meet the relevant password-authentication requirements. According to the technical explanation published by Ars Technica, one account must be passwordless, with an asterisk recorded in /etc/shadow. A separate account must hold a password hash based on either SHA-256 or SHA-512.

For a passwordless account meeting those conditions, the reported authentication bypass involves submitting a password exceeding 256 characters. On that error path, the password-hashing function in musl produces an asterisk. OpenSSH can then treat that result as matching the asterisk stored for the account in the shadow file, according to the technical account.

Observations reported by security companies cover both attempted and successful exploitation. BleepingComputer reported that firms first detected attempts on November 5, 2026, with successful exploitation observed the next day. Its account separately placed GreyNoise’s first successful exploitation recorded by its own sensors at 00:46 UTC on November 7.

GreyNoise said a group it identifies as GT10 attacked its honeypots in Southeast Asia. According to Ars Technica’s account of the investigation, GreyNoise described those events as intrusions and subsequently accessed a server belonging to GT10. That examination covered the group’s tools and possible victims, rather than establishing every possible victim as a confirmed compromise.

A separate set of sensor observations attributed to Previdian covered a period ending November 8, 2026. Ars Technica reported a total of 20 exploitation attempts involving 13 different IP addresses associated with nine countries. Those figures describe attempts, not a count of 20 successful logins.

A fix for SSHole had been released by OpenSSH, according to Ars Technica. The project’s release notes date the release of Portable OpenSSH 10.6p2 to November 5, 2026.

* This article is based on publicly available information at the time of writing.

More from Cybersecurity

  1. Exploitation requires a user to open a specially prepared message file; Outlook may then contact an attacker-controlled network destination without its usual warning.

  2. N-able advised customers running N-central on their own premises to disconnect their servers until further instructions.

  3. D-Link’s interim advice is to disable DDP on the switch and applicable interfaces; the company said this stopped tested DDP attack paths.

  4. Docomo’s estimate puts the affected records at up to 300,000; emergency maintenance on both services was still underway on November 6.

  5. Access requires identity verification; organisations must also use single sign-on and multi-factor authentication, with API access restricted by IP allowlisting.