#3
SecurityWeek
general
November 06, 2026 at 12:07 UTC
OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass
By Ionut Arghire
AI Summary
OpenSSH patched CVE-2026-123158, dubbed 'SSHole,' an authentication bypass affecting Linux systems running musl libc (such as Alpine Linux) with PAM disabled, where accounts accept any password between 257 and 1,024 characters. Threat actors began exploitation attempts within hours of disclosure, with Previdian researchers confirming root access achieved on a honeypot. Administrators running musl-based Linux distributions should apply patches immediately and audit PAM configurations.
Relevance score: 89.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →