Hackers are actively exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access on Linux systems.
Multiple cybersecurity firms have confirmed the attacks, reporting that exploitation attempts began on November 5, the day a proof-of-concept exploit became available, with successful exploitation recorded the following day. Disclosed by security researcher Ozgun Kultekin last week, SSHole allows bypassing authentication in OpenSSH running on certain musl-based Linux systems, including the lightweight Alpine Linux distribution used in cloud and virtual environments.
The flaw lets attackers log in to accounts whose password hash is set to an asterisk (*) to prevent password logins. An oversized password causes musl’s password-hashing function to return * on error, which OpenSSH mistakenly treats as a match for the account’s stored value. Kultekin explained that exploitation requires specific authentication settings, does not affect accounts with valid password hashes, and can lead to root access where the compromised account has passwordless administrative privileges.
OpenSSH maintainers fixed the vulnerability in version 10.6p2 released on November 5, while exploit code became available roughly four hours later. Finnish security company Defused said over the weekend that it had observed "a small amount of actors" trying to exploit SSHole, although the activity was not widespread.
Threat intelligence company GreyNoise recorded the first successful exploitation of SSHole in the wild on November 7 at 00:46 UTC, approximately 40 hours after the fix. The researchers logged 16 successful exploitation chains targeting networks protected by GreyNoise from six source IP addresses linked to post-exploitation activity.
In the attacks that GreyNoise observed, the threat actor ran system and container reconnaissance, initiated queries to cloud metadata services, attempted to read password hashes and root SSH keys, and tried to modify SSH ‘authorized_keys’ files to gain persistent access. One attacker gained root privileges and installed TAC Agent, a Python command-and-control agent. However, the implant couldn’t reach its command-and-control (C2) server at ‘tac.vpnla[.]org,’ and never received a task.
Analysis of the TAC Agent payload shows that the implant supports shell command execution, extensive system reconnaissance, file upload/download operations, and can update itself. The agent has no built-in persistence, so the attackers attempt to secure it by configuring a startup service. GreyNoise notes that the implant’s comments, logs, and errors were in Chinese, which may be used in conjunction with other evidence to determine the attacker’s origin.
Sensors from network security company Previdian also confirmed successful SSHole exploitation, with telemetry data showing 20 attempts from 13 attacker IP addresses in nine countries. Offensive security firm watchTower said on November 6 that it observed SSHole being exploited in attacks associated with botnets and cryptomining activity.
System administrators should update OpenSSH as soon as possible, or disable SSH password authentication on systems affected by SSHole. It is also recommended to check for unexpected successful password logins to accounts whose /etc/shadow password field is *, unauthorized SSH keys, and TAC Agent files or startup services.
