OpenSSH’s 10.6p2 release fixes an authentication bypass on some Linux systems, and exploitation attempts were reported within hours of disclosure. Threat-intelligence firm Previdian told The Hacker News that one attempt reached root on its Alpine Linux honeypot. That is evidence of a successful break-in to a controlled sensor, not proof that production servers have been compromised.
The issue, tracked as CVE-2026-123158 and nicknamed “SSHole,” combines OpenSSH behavior with the musl C library on systems that do not use PAM for password checks. OpenSSH’s 10.6p2 release notes call the update a critical security workaround for Linux systems using musl with PAM disabled. Alpine’s advisory explains that a long password can trigger a musl error value that matches the marker stored for an account with no password. In the affected configuration, sshd can mistake that failed check for a successful login.
The exposure depends on configuration
This is not a blanket OpenSSH or Linux flaw. The vulnerable combination requires OpenSSH built against musl without PAM, password authentication enabled, an account whose password field is marked “*,” and another local account with a password hash. Alpine’s standard non-PAM OpenSSH package and default password-authentication setting make the conditions plausible there; the project lists affected releases from 3.16 through 3.24 and edge. Systems using glibc, PAM-enabled OpenSSH, Dropbear or non-Linux OpenSSH are outside the described scope.
A passwordless or key-only account is not automatically exposed on every machine. Alpine notes that its default root SSH setting still blocks direct root login; a separate account’s existing permissions determine what access an attacker would gain. Some Alpine cloud images include an “alpine” account that can use doas, but exposure still depends on the machine’s configuration and the presence of another hashed account.
The honeypot report is not a victim count
The Hacker News reported that Previdian had seen eight attempts at one sensor, all from a single source address, and that one reached root on its Alpine honeypot. A honeypot is controlled infrastructure designed to attract and record suspicious traffic. That result shows the flaw moved quickly from disclosure into practical testing; it does not establish a production compromise, the size of an active campaign, or how many exposed machines are online. The same report said CISA had not yet added the CVE to its Known Exploited Vulnerabilities catalog. Administrators should still follow the direct OpenSSH and Alpine advisories for scope and fixes.
Patch the daemon, not just the package
OpenSSH 10.6p2 fixes the issue, and Alpine has issued patched packages for its supported and older branches. Alpine warns that updating the package does not replace an already running sshd: administrators must restart the service for the fix to take effect. If an update cannot be applied immediately, Alpine recommends disabling password authentication and restarting sshd. Its advisory also tells operators to look for accepted-password logins to accounts that should not accept passwords, then review privilege use, new users and authorized keys. If an unexplained login cannot be ruled out, Alpine says to treat the system as compromised.
TINA’s view: The urgent fact is the combination of a remotely reachable authentication bypass, a fix that is already available, and a honeypot report of successful access. The reported sensor result does not establish widespread victimization, and the narrow prerequisites matter. But for operators who do meet them, waiting offers no benefit: patch and restart, or temporarily turn off password logins while checking exposure. The next useful evidence is whether maintainers and administrators close the gap—and whether investigators find real-world victims beyond honeypots.
This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. The hero is an original AI-generated editorial illustration.
