CVE-2026-123158

SSHole OpenSSH Flaw Actively Exploited in Wild Attacks on musl-Based Linux Systems

Hackers began exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH just hours after a proof-of-concept exploit was published on November 5, 2026. The flaw affects certain musl-based Linux distributions, including Alpine Linux, allowing attackers to bypass authentication on accounts whose password hash is set to an asterisk in /etc/shadow. Multiple security firms including GreyNoise, Defused, Previdian, and watchTower have confirmed successful exploitation attempts involving reconnaissance, credential theft, and persistence mechanisms. GreyNoise recorded the first confirmed in-the-wild success on November 7 at 00:46 UTC, with 16 exploitation chains from six IP addresses that included queries to cloud metadata services and installation of the TAC Agent implant. OpenSSH maintainers released version 10.6p2 on November 5 to address the issue, while researchers recommend disabling password authentication and checking for unauthorized SSH keys or TAC Agent services on affected systems.

Weekly Cybersecurity Recap: OpenSSH SSHole Exploitation, Debian APT Root RCE, Zyxel Zero-Day, and AI-Driven Attacks

This week's cybersecurity news highlights active exploitation attempts against an OpenSSH flaw allowing passwordless logins on specific Linux configurations. A trojanized Control Web Panel update mechanism is distributing the stealthy CWPdoor backdoor, while a Debian and Ubuntu APT vulnerability enables root-level code execution under retry conditions. Zyxel patched a zero-day in its GS1900 switches exploited by Kapibala to compromise nearly 1,000 devices. CERT-In reported AI-assisted Crafty Falcon targeting financial organizations with re-attacks timed for low-monitoring periods. Additional incidents include hijacked cPGuard updates, mSecure password manager issues, Qilin ransomware claims, and a CPython zero-day affecting AI sandboxes.