Last week, TechJuice reported on *sshole, a decade-old OpenSSH flaw that lets attackers log into password-disabled accounts on musl-based Linux systems using an oversized password. At the time, no attacks had appeared in the wild. However, that changed fast. Threat intelligence firm Previdian has now confirmed that attackers exploited the vulnerability less than nine hours after its public disclosure on November 5.
As a result, attackers gained root access on a honeypot running Alpine Linux and OpenSSH. There is no custom payload to craft, which makes sense given how simple and speedy the exploit is.
An attacker simply sends a password between 257 and 1,024 characters through a standard SSH connection. If the target runs OpenSSH on musl-based Linux with PAM disabled, authentication succeeds immediately. In other words, the entire attack fits in a single terminal command. Furthermore, automated scanners can identify vulnerable instances within minutes and attempt the bypass at scale.
The flaw now carries the formal designation CVE-2026-123158 with a CVSS score of 8.1 (high severity). Researcher Ozgun Kultekin discovered it on November 3 using AI agents that ran roughly 17,600 tests. He then reported it to OpenSSH the same day. By November 5, OpenSSH shipped version 10.6p2 and Alpine released patched packages across every branch from 3.16 through edge. In short, the maintainers moved fast. The attackers, however, moved faster.
The threat also extends into container infrastructure. Alpine Linux is one of the most popular Docker base images. Most containers do not expose SSH. On the other hand, those used for development environments, jump boxes, and legacy applications frequently do. Consequently, a single unpatched container with a reachable SSH daemon becomes a network entry point.
For detection, administrators should check SSH logs for accounts where the password field contains an asterisk. If those logs also show an “Accepted password” entry for such an account, then the system may already face compromise. The fix requires updating to OpenSSH 10.6p2 or installing the patched Alpine packages. Alternatively, disabling password authentication in the SSH configuration blocks the attack entirely as a temporary workaround.
