A flaw in OpenSSH, a common remote login tool, let attackers into some Linux servers, and the first attack attempt came under nine hours after the flaw went public.
Attackers started going after a newly disclosed login flaw in OpenSSH less than nine hours after it was made public. The flaw, nicknamed SSHole, can let a stranger log in to certain server accounts without a password. Security firm Previdian says it confirmed a successful break-in with full control on a decoy server running Alpine Linux.
OpenSSH is a widely used tool for logging in to servers remotely. The flaw is tracked as CVE-2026-123158 and has a severity score of 8.1. Security researcher Ozgun Kultekin discovered it. Previdian says its decoy server, called a honeypot, was hit by eight attempts from one internet address that appears to be in Japan. The attacker then ran basic commands to learn about the machine, including id, uname and hostname.
Some accounts are set up so that no password can be used. Their password field holds an asterisk instead. An attacker can send an oversized password, between 257 and 1,024 bytes long. In the affected setup, the server's attempt to check it fails, and the failure produces an asterisk. The server then compares that asterisk with the one stored for the account and lets the attacker in. The root cause traces back to a 2016 patch.
The risk applies to Linux systems running OpenSSH with the musl C library, a set of basic building blocks programs rely on, and with PAM turned off. PAM is a standard system for checking passwords. Alpine Linux's default OpenSSH server setup falls into this group. An attacker also needs an account with an asterisk as its password. Accounts with real passwords cannot be bypassed this way.
Safe Security notes that an attacker gets the permissions of the account they break into. That could expose deployment credentials, application secrets and connected systems, and it could allow attackers to move deeper into a network.
Dropbear, Linux distributions based on glibc, non-Linux systems and systems that check passwords through PAM are not affected.
The fix is OpenSSH 10.6p2, or your Linux distribution's patched package. The server program must be restarted after the update. The alert box above lists the steps, including what to look for in the logs. Alpine's guidance is blunt: if a login cannot be ruled out, treat the machine as compromised.
The material does not say how many servers have been hit beyond the Previdian honeypot. What it does show is how fast attackers move once a flaw is public. Anyone running Alpine servers with the default OpenSSH setup should not wait for a quiet moment to update.
If you run Alpine Linux servers, update OpenSSH to 10.6p2, restart the server program and check your logs for suspicious password logins.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
