Active Exploitation of 'SSHole' Flaw Compromises Alpine Linux Servers

Key points

• The vulnerability, dubbed 'SSHole', arises from an interaction between OpenSSH and the musl C library, specifically affecting systems that do not use PAM for authentication.
• Attackers exploit the flaw by sending passwords between 257 and 1,024 bytes to accounts with a password field set to '*', causing the system to incorrectly accept the login.
• Active exploitation has been confirmed by security firms Greynoise, watchTowr, and Previdian, with some attacks linked to botnets and cryptocurrency theft.
• OpenSSH released version 10.6p2, and Alpine Linux issued fixed packages for all supported releases, including those past end-of-life, to address the issue.
• Administrators are advised to update immediately or disable password authentication, and to check logs for suspicious 'Accepted password' entries for accounts that should not allow password logins.

Background

This incident follows a recent pattern of active exploitation of critical Linux vulnerabilities, as noted in our archive. In late October 2026, CISA urged federal agencies to patch GitLab and Cisco flaws, and in early November, a SonicWall MFA bypass flaw was added to the Known Exploited Vulnerabilities catalog. The 'SSHole' vulnerability, which has roots in a 2016 patch for CVE-2016-6210, highlights ongoing risks in legacy code interactions.

How outlets are covering it

Ars Technica and The Hacker News emphasize the critical nature of the flaw and the speed of the patch response, with OpenSSH releasing a fix within days of discovery. ZDNET highlights the broad impact on musl-based distributions, including Adélie, Void, and Sabotage Linux, while BleepingComputer focuses on the technical details of the exploitation and the role of AI agents in discovering the flaw. Greynoise reported 'mature intrusions' by a group tracked as GT10, while watchTowr linked exploitation to botnets and cryptocurrency. All sources agree on the need for immediate action, with The Hacker News noting that no CVE identifier had been assigned at the time of their report, though Ars Technica and others reference CVE-2026-123158.

Why it matters

The 'SSHole' vulnerability poses a significant threat to the security of Linux systems, particularly those using Alpine Linux and other musl-based distributions. The ease of exploitation, requiring only network access and an account name, makes it a high-risk issue for any exposed SSH server. The active exploitation by multiple threat actors underscores the need for immediate patching and security audits to prevent widespread compromise.

What to watch

Administrators should immediately update OpenSSH to version 10.6p2 or apply the latest Alpine Linux patches. Those unable to update should disable password authentication and restart the SSH service. Security teams should monitor logs for suspicious activity and review recently created users and authorized keys. Ongoing vigilance is required as attackers continue to exploit the vulnerability.