Attackers are now using SSHole (CVE-2026-123158), the OpenSSH password bypass flaw we covered on November 6, to break into Linux servers. GreyNoise says on its SSHole activity page that it saw the first successful attack on November 7 at 00:46 UTC, about 40 hours after OpenSSH shipped the fix in version 10.6p2. BleepingComputer reported on November 9 that watchTowr, Previdian and Defused have also seen exploitation attempts.
What’s new
The bug hasn’t changed. It affects OpenSSH on musl-based Linux, such as Alpine, which is common in Docker containers and small cloud servers. Accounts whose password field is set to an asterisk, a common way to block password logins, can be entered with an oversized password when password authentication is switched on.
The change is the activity. GreyNoise lists intrusions where attackers mapped the system, queried cloud metadata services, tried to read SSH keys and added their own keys to authorized_keys. In one case an attacker got root and installed a Python remote-control agent, which GreyNoise says never reached its control server. watchTowr tied other attempts to botnets and cryptomining, according to BleepingComputer.
Who it affects
Businesses that run their own Alpine-based servers or containers with SSH open to the internet and password logins turned on. Accounts with a real password hash aren’t affected, according to the researcher’s disclosure.
Most small business websites on shared or managed WordPress hosting don’t run their own SSH service on Alpine, so the patch is the host’s job there. If a developer set up a VPS or a container for your site, booking system or internal tools, ask them which base image it uses.
Our take
Patching now doesn’t clean up a server that was already entered. We’d update to OpenSSH 10.6p2 or turn off password authentication today, then check three things GreyNoise and BleepingComputer point to: successful password logins to accounts whose shadow password field is an asterisk, SSH keys you don’t recognize in authorized_keys, and new startup services. If any of those turn up, treat the server as compromised and rebuild it from a clean image rather than patching in place.
Not sure what your host or developer runs? Our website maintenance work includes server and patch checks, and IT consulting covers bigger infrastructure decisions.
