November 7, 2026
- CVE-2026-123158 ("SSHole") is now being exploited. watchTowr Intel says it is seeing exploitation in the wild, "for now, botnets and crypto miners" (watchTowr), and Previdian reported attackers reaching root on a honeypot within hours of disclosure (The Hacker News). The bug (CVSS 8.1) lets a password of 257–1,024 bytes authenticate as accounts with no usable password on musl-based Linux running sshd without PAM — Alpine's default, plus OpenWrt, Buildroot and Yocto builds. Fix is OpenSSH 10.6p2, or
PasswordAuthentication no; Alpine has backported to 3.16 and Denmark's national CERT pushed its own advisory (CERT.dk). The flaw dates to 2016 and was found by a researcher running AI agents through roughly 17,600 authentication tests (BleepingComputer) (earlier coverage) (discussion). · Vulnerabilities & Exploitation