Previdian

Attackers Exploit OpenSSH 'SSHole' Flaw on musl Systems to Deploy Botnets and Cryptominers

Cybersecurity firms have reported active exploitation of a vulnerability in OpenSSH affecting systems that use the musl library, including Alpine Linux, OpenWRT, Buildroot, and Yocto. The flaw, nicknamed 'SSHole', allows attackers to bypass authentication on accounts configured with no password by supplying a password longer than 256 characters. The issue occurs when OpenSSH runs on musl without PAM, with password authentication enabled and specific account configurations present. OpenSSH 10.6p2 was released on November 5, 2026, with a mitigation after the vulnerability was disclosed on November 4. Initial attacks began within nine hours of the patch release, with observed activity limited to botnet recruitment and cryptominer installation. The Dutch NCSC recommends restricting SSH exposure and disabling password authentication where possible.