2 publishers · first seen Mon, 09 Nov 2026 16:04 UTC · updated Mon, 09 Nov 2026 19:41 UTC
Hackers are exploiting the SSHole vulnerability (CVE-2026-123158) in OpenSSH, allowing them to execute commands, steal credentials, and gain persistent access. The vulnerability, which affects certain musl-based Linux systems, was disclosed by security researcher Ozgun Kultekin and has been confirmed by multiple cybersecurity firms. Exploitation began on November 5, the day a proof-of-concept exploit became available, with successful exploitation recorded the following day. OpenSSH maintainers released a fix on November 5, but attackers have already begun exploiting the vulnerability. System administrators are advised to update OpenSSH promptly and check for signs of exploitation, such as unexpected successful password logins to accounts with a password field set to an asterisk (*) in /etc/shadow, unauthorized SSH keys, and TAC Agent files or startup services.
Content auto-generated. May contain inaccuracies.