A flaw nicknamed "SSHole" surfaced in the quiet infrastructure that many servers depend on, where a long password can open a door that should have stayed shut. Born from two separate weaknesses, one in OpenSSH and one in the musl C library that Alpine Linux relies on, it asks nothing of an intruder but patience with a string of characters. Almost as soon as the flaw was made known, it was turned against a decoy machine set to catch intruders, a reminder that disclosure and attack can now arrive in the same hour. The patches are out, and the work that remains is the slow, unglamorous task of ap
Hackers Exploit OpenSSH 'SSHole' Auth Bypass Within Hours of Disclosure, Gaining Root on Honeypot
Exploitation began within hours of disclosure
Mark
Why is everyone treating this one as urgent?
Mimi
Because the trigger is so simple. A password over 256 characters gets past authentication, according to the headlines, and attackers were using it within hours of disclosure.
Mark
What does the honeypot tell us?
Mimi
That someone got root on a decoy machine very quickly. It's a signal that exploitation started almost right away.
Luke
But a honeypot is one system. The reporting I can see doesn't say how many real machines were hit, or by whom.
Mark
And the flaw itself, is it one bug?
Mimi
Two. One in OpenSSH, one in musl-libc, which Alpine uses. They combine to produce the bypass.
Luke
Worth noting that "other distros" is vague. Alpine is named clearly; which others are affected isn't spelled out here.
Mark
So what should administrators do?
Mimi
Apply both sets of emergency patches, OpenSSH and musl-libc, and watch for further exploitation.
Luke
And "millions of systems" is a headline estimate, not a measured count. Treat it as scale, not a number.
Il Polso
- Attackers gained root on a honeypot within hours of the flaw being disclosed, leaving almost no grace period for defenders.
- A password longer than 256 characters can bypass authentication, requiring no stolen credentials or complex technique.
- Two separate weaknesses, in OpenSSH and musl-libc, combine to open the gap, so fixes must land in two components at once.
- Emergency patches for OpenSSH and musl-libc are already issued for millions of systems, and administrators are urged to update immediately.
- Watchers are waiting to see whether exploitation spreads beyond the honeypot and which other distributions prove affected.
A flaw nicknamed "SSHole" surfaced in the quiet infrastructure that many servers depend on, where a long password can open a door that should have stayed shut. Born from two separate weaknesses, one in OpenSSH and one in the musl C library that Alpine Linux relies on, it asks nothing of an intruder but patience with a string of characters. Almost as soon as the flaw was made known, it was turned against a decoy machine set to catch intruders, a reminder that disclosure and attack can now arrive in the same hour. The patches are out, and the work that remains is the slow, unglamorous task of applying them everywhere they are needed.
Within hours of the public disclosure of a flaw nicknamed "SSHole," attackers were already using it. According to The Hacker News, they gained root access on a honeypot, a decoy system built to observe how intruders behave. That speed is the heart of the story.
The flaw, tracked as CVE-2026-123158, is a password authentication bypass affecting OpenSSH on Alpine Linux and some other distributions. It grows from two weaknesses working together, one in OpenSSH and one in musl-libc, the C library Alpine uses. Neither alone is described as the whole problem, yet together they open a door.
The trigger is almost embarrassingly simple. A password longer than 256 characters is enough to get in, regardless of its content. That is what makes it dangerous: no stolen credentials and no elaborate technique are required.
Coverage spread across several outlets. OpenSSH rushed out patches, and emergency fixes for both components have been issued for millions of systems. Because the flaw spans two components, the remedy means two sets of updates.
The honeypot result should be read carefully. It does not reveal how many production systems were compromised, name any victims, or identify the attackers. What it does show is that exploitation began almost immediately, so no one should count on a grace period. For anyone running Alpine Linux or another affected distribution, the step is clear: apply the updates now and watch for further exploitation.
Within hours of the public disclosure of a flaw nicknamed "SSHole," attackers were already using it. According to reporting from The Hacker News, they gained root access on a honeypot, a decoy system set up to watch how intruders behave. The speed of that exploitation is the center of the story.
The flaw is tracked as CVE-2026-123158. It is a password authentication bypass affecting OpenSSH on Alpine Linux and some other distributions. It arises from a combination of weaknesses: one in OpenSSH and one in musl-libc, the C library that Alpine uses. Neither piece alone is described as the whole problem. Together they open a door.
The trigger is strikingly simple. According to the Tom's Hardware headline, anyone can get in by typing a password longer than 256 characters. The content of the password does not matter, only its length. That is what makes the bug dangerous: it requires no stolen credentials and no elaborate technique.
Coverage came from several outlets at once. Ars Technica introduced the bug under the name *sshole and described it as a way for hackers to SSH into Linux devices. OX Security published a technical write-up titled for the OpenSSH password authentication bypass on Alpine Linux. SecurityWeek reported that OpenSSH rushed out patches for the authentication bypass.
Tom's Hardware framed the scale: emergency fixes for both OpenSSH and musl-libc have been issued for millions of systems, with the advice to patch immediately. Because the flaw spans two components, the remedy involves two sets of updates rather than one.
The honeypot result should be read carefully. The available material reports that attackers obtained root on the decoy machine shortly after disclosure. It does not give a count of compromised production systems, name victims, or identify the attackers. What it does establish is that exploitation began almost immediately, so administrators cannot assume a grace period between disclosure and attack.
For anyone running Alpine Linux or another affected distribution, the practical step is to apply the OpenSSH and musl-libc updates now and watch for signs of further exploitation. Reports of real-world compromises beyond the honeypot, and details on exactly which distributions are affected, are the things to watch next.
Citazioni salienti
Emergency fixes for OpenSSH and musl-libc have been issued for millions of systems; patch immediately.— Tom's Hardware
Vuoi la storia completa?
Leggi l'originale su Google News ↗
General News