Hackers exploit SSHole OpenSSH flaw to breach Linux systems

OpenSSH maintainers released version 10.6p2 to fix an authentication bypass vulnerability tracked as CVE-2026-123158, dubbed SSHole, which threat actors are actively exploiting across Linux infrastructure. Disclosed by researcher Ozgun Kultekin, the flaw allows attackers to execute commands, steal credentials, and gain root access, as detailed in BleepingComputer's report. Multiple cybersecurity firms confirmed that active exploitation began immediately after proof-of-concept exploit code emerged.

This report covers the mechanics of the SSHole flaw, observed network telemetry across threat monitoring firms, deployed post-exploitation malware, and necessary mitigation procedures. The analysis is intended for system administrators, DevOps teams, and security engineers operating Linux distributions across cloud, container, and virtual environments. Readers will find verified timelines, threat intelligence findings, and administrative checklist items to secure vulnerable infrastructure.

01Musl password hashing and asterisk account handling

The SSHole flaw exists in the interaction between OpenSSH and musl-based Linux environments, notably the lightweight Alpine Linux distribution common in container deployments. The vulnerability targets accounts where the password hash is set to an asterisk to disable password logins. Submitting an oversized password forces musl's password-hashing function into an error state that returns an asterisk character.

OpenSSH mistakenly treats the asterisk returned by the failed hashing function as a match against the stored asterisk value in /etc/shadow. This logic error allows attackers to bypass authentication on systems with vulnerable settings without supplying valid credentials. Kultekin explained that accounts configured with valid password hashes remain unaffected by the issue.

Exploitation can lead to root access if the targeted account possesses passwordless administrative privileges on the host. Because Alpine Linux serves as a common base image across cloud environments, many organizations maintain instances relying on musl libc error handling. Accounts intended to be protected from password logins become direct entry vectors for remote attackers.

02OpenSSH security update and rapid exploit release

OpenSSH maintainers published version 10.6p2 on November 5 to fix the improper hash comparison logic and block unauthorized logins. Public proof-of-concept exploit code became available roughly four hours after the official update appeared online. Malicious actors began weaponizing the proof of concept almost immediately, launching exploitation attempts on the same day the patch shipped.

Cybersecurity firms confirmed that successful in-the-wild exploitation occurred on November 6, just one day after the vulnerability disclosure. Finnish security firm Defused stated over the weekend that it observed a small amount of actors attempting to exploit SSHole across monitored networks. Defused noted that while the initial attempts showed targeted interest, malicious activity remained limited in scope.

Offensive security firm watchTower reported observing SSHole exploitation attempts on November 6 associated with automated botnets and cryptomining activity. The four-hour gap between patch distribution and public exploit availability left minimal defense time for engineering teams managing distributed container clusters. Attackers quickly integrated the vulnerability into broad opportunistic scanning tools targeting public cloud IP ranges.

03Telemetry findings across global security sensors

Threat intelligence company GreyNoise recorded the first successful exploitation of SSHole in the wild on November 7 at 00:46 UTC, roughly 40 hours after the fix. GreyNoise logged 16 successful exploitation chains targeting its protected monitoring networks from six source IP addresses linked to post-exploitation operations. The company clarified that these attacks represent specific sensor telemetry rather than total global activity.

Sensors from network security company Previdian also confirmed successful intrusions, recording 20 exploitation attempts from 13 attacker IP addresses in nine countries. This geographic distribution indicates that multiple independent threat actors adapted the public exploit code across disparate hosting infrastructures. The telemetry confirms that exploitation operations expanded rapidly across international boundaries following public disclosure.

In aggregate telemetry, GreyNoise recorded 27.5 million port-22 scans alongside 20.1 million attempted SSH sessions during this monitoring period. While these broader numbers represent general internet background noise rather than confirmed SSHole attempts, they demonstrate the heavy baseline scanning confronting SSH services. Any misconfigured or unpatched Alpine system connected directly to the internet faced immediate discovery.

04Cloud reconnaissance and the Python TAC Agent

In attacks monitored by GreyNoise, threat actors executed system and container reconnaissance and initiated queries to cloud metadata services. Intruders attempted to read local password hashes and root SSH keys while modifying SSH authorized_keys files to gain persistent access. These initial discovery steps allowed attackers to evaluate instance permissions and establish secondary footholds across compromised environments.

One attacker escalated to root privileges and installed TAC Agent, a specialized Python command-and-control implant. Analysis of the TAC Agent payload revealed support for shell command execution, host reconnaissance, file upload and download operations, and self-updating routines. However, the implant failed to reach its command-and-control server at tac.vpnla[.]org and never received an operational task.

Because TAC Agent lacks built-in persistence, attackers attempted to secure access by configuring a custom startup service on the compromised host. GreyNoise researchers noted that internal comments, logs, and error messages within the implant were written in Chinese. Researchers also identified a missing tool check that returns feedback to help an automated planner revise commands dynamically.

05Administrative mitigation and system inspection steps

System administrators should update OpenSSH to version 10.6p2 immediately across all impacted servers, container clusters, and virtual machine templates. On systems where package updates cannot be deployed immediately, administrators must disable SSH password authentication entirely within the sshd configuration. Enforcing public-key authentication prevents the vulnerable musl libc password-hashing routine from executing during connection attempts.

Security personnel should inspect system authentication logs for anomalous successful password logins to accounts whose /etc/shadow password field is set to an asterisk. Any recorded password login against an asterisk-designated account indicates a probable SSHole compromise. Defenders must also audit SSH authorized_keys files across all user profiles to detect unauthorized public keys inserted by attackers.

Organizations must search filesystem directories for unexpected Python scripts, suspicious startup services, and indicators associated with TAC Agent or C2 communications to tac.vpnla[.]org. Identifying newly added system services or altered configuration files is critical to preventing ongoing attacker access. Promptly removing persistence mechanisms and updating OpenSSH ensures affected Linux hosts remain protected against active exploitation.