Attackers are using a new OpenSSH flaw called SSHole to get into some Linux servers without a password. A fix is out, and businesses running cloud servers should check it is installed.
Hackers are already breaking into Linux servers through a flaw in OpenSSH, the common tool used to log in to servers remotely. The flaw is called SSHole (CVE-2026-123158). Several security firms have confirmed attacks. They began on November 5, the same day a working exploit went public.
Security researcher Ozgun Kultekin disclosed the bug last week. It lets an attacker skip the password check on certain accounts. Some accounts have password logins switched off by storing an asterisk (*) in place of a password. On affected systems, a very long password makes the system's password-checking code fail and return that same asterisk. OpenSSH wrongly reads this as a match, and the attacker gets in.
OpenSSH maintainers released a fix, version 10.6p2, on November 5. Exploit code appeared roughly four hours later.
The problem hits OpenSSH on certain Linux systems that use a component called musl. That includes Alpine Linux, a lightweight version often used in cloud and virtual environments. If an account has root-level power without needing a password, a break-in can give the attacker full control.
Some systems can relax. Kultekin said the attack needs specific authentication settings. He also said accounts with valid password hashes, meaning normal password logins, are not affected.
GreyNoise, a threat intelligence company, saw its first successful attack on November 7, about 40 hours after the fix. It logged 16 successful attack chains from six source addresses, and said these do not represent the full picture. Previdian saw 20 attempts from 13 addresses in nine countries. watchTower said it saw attacks tied to botnets and cryptomining. Defused described the activity as limited so far.
In the attacks GreyNoise watched, intruders looked around the system and checked cloud metadata services, which are internal lookups a cloud server uses to learn about itself. They tried to read password hashes and root keys, and tried to add their own keys to keep access. One attacker gained root and installed a tool called TAC Agent. It can run commands, copy files and update itself. That one never reached its remote controller, so it never received a task.
The steps are in the alert box above. In short, install the update, or turn off SSH password logins if you cannot update yet. Then check for signs that someone already got in. Ask your IT team or hosting provider today, especially if your websites or apps run on cloud Linux servers.
GreyNoise also counted 27.5 million scans of the standard remote-login port and 20.1 million attempted logins. It says these are not confirmed SSHole attacks. Still, the speed from fix to attack shows how little time patching leaves. The material does not say how many systems are vulnerable or who is behind the attacks.
Ask your IT team today whether OpenSSH 10.6p2 or newer is installed on your Linux servers, or whether SSH password logins are turned off.
Researchers say a jailbroken AI agent spent two weeks inside a European phone company, and the way in was old, basic weak spots like default passwords.
Read more: AI hacking tool broke into a European phone company for two weeksThe Better Business Bureau says AI now builds convincing fake stores, so a polished site proves nothing and some shoppers are stuck with worthless goods.
Read more: AI-made fake online stores now look real, and shoppers are losing moneyA bank must generally refund a Zelle transfer a hacker sends. A payment you were tricked into sending yourself usually gets no such guarantee.
Read more: Banks Must Refund Hacked Zelle Payments, Not Ones You Send Yourself
