InfrastructureCompute, chips & cloud
OpenSSH 'SSHole' flaw lets attackers log in to Alpine and other musl-based Linux systems and is now being actively exploited
A flaw in OpenSSH versions before 10.6p2 lets attackers log in to passwordless accounts on musl-based Linux systems, mainly Alpine, by sending an overlong password. Exploitation attempts began within hours of the 5 November fix. CISA set a 12 November federal deadline.
From the Ars Technica · AI article of November 9, 2026 and cited sources: The bug comes from three error-handling choices colliding, not from memory corruption. [2] [1]
SOURCES[2] Brain Detox: musl crypt() returns * braindetox.kr[1] Vulnerability that lets hackers SSH into Linux devices is… arstechnica.com
AT Pulse research deskPublished · Updated · 4 min read · AI-assisted analysisAI-assisted, not human-edited. Methodology Corrections Who owns this site
- What happened
- The bug comes from three error-handling choices colliding, not from memory corruption. [2] [1]
- Original source
- Ars Technica · AI article, independent perspective
- Brief by
- AT Pulse research desk AI-assisted; publisher and contact on the desk page
- When
- November 9, 2026 article published
- Covered
- Nov 12 edition
- Evidence
- 10 sources across 10 sites
- 1Vulnerability that lets hackers SSH into Linux devices is…arstechnica.com
- 2Brain Detox: musl crypt() returns *braindetox.kr
- 3oss-security: OpenSSH 10.6p2 announcementopenwall.com
- 4BleepingComputer: Hackers exploit SSHole OpenSSH flawbleepingcomputer.com
- 5The Hacker News: CISA warns of active exploitationthehackernews.com
- 6GreyNoise: SSHole activity trackersshole.events.greynoise.io
Reach: not measured yet
The bug comes from three error-handling choices colliding, not from memory corruption. On failure, musl's crypt() returns '*' rather than NULL. Since a 2016 timing-leak fix, OpenSSH hashes every login attempt. Alpine marks passwordless accounts with '*'. As a result, a password longer than 256 bytes produces a 'hash' that matches those accounts, and sshd lets the attacker in. [2] [1]
A system is exposed only if several conditions hold: OpenSSH older than 10.6p2, musl libc, PAM disabled, at least one account with a SHA-256 or SHA-512 password hash, and a passwordless account marked '*'. Alpine's default openssh-server package fits this pattern most closely. OpenWrt, Buildroot, Yocto and many Docker images also need checking. glibc systems are not affected, and Red Hat says none of its products are. [7] [1] [8] [9]
Attacks started quickly. A proof-of-concept appeared about four hours after the patch, and the first attempts followed within nine hours. GreyNoise recorded a successful compromise on 7 November. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 9 November. The counts come from security firms' own sensors and keep changing: one tally reached 22 attempts from 14 IPs, and GreyNoise now lists 40 attacker IPs. Reported activity includes botnets, cryptocurrency mining and a group GreyNoise calls GT10, which deployed a TAC Agent backdoor that never activated on the victims GreyNoise observed. [4] [7] [6] [5] [1]
Established: the login bypass is confirmed, patched and listed by CISA as actively exploited. Implication: Alpine-based containers and slowly patched embedded devices may stay exposed after hosts are fixed.
Read the full assessment
A library that signals errors with normal-looking values can quietly break authentication.
Executive brief
The bug that let attackers into Linux machines was not a memory-corruption flaw. It came from two error-handling conventions that happen to collide. On Linux systems built with the musl C library, the password-hashing function returns when it fails. A in /etc/shadow is also how Alpine marks an account that has no password. So a password longer than 256 bytes produces a hash that "matches" a passwordless account, and sshd logs the attacker in (Brain Detox). OpenSSH shipped a fix in 10.6p2 on 5 November 2026 (oss-security). Successful attacks were recorded within days (BleepingComputer), and CISA gave US federal agencies until 12 November to patch (The Hacker News).
What changed and event timeline
Fix committed
GreyNoise's tracker dates the OpenSSH fix commit one day before the public release ().
OpenSSH 10.6p2 and first attack
OpenSSH released 10.6p2, crediting Özgün Kültekin of Wakefield with the report (). Alpine patched branches 3.16 through edge the same day. Previdian saw its first exploitation attempt less than nine hours later ().
Botnet activity reported
WatchTowr said the exploitation it observed was linked to botnets and cryptocurrency mining. A proof-of-concept exploit had appeared about four hours after the patch ().
GreyNoise confirms compromise
GreyNoise recorded its first successful in-the-wild exploitation at 00:46 UTC ().
CISA KEV listing and GT10 report
CISA added CVE-2026-123158 to its Known Exploited Vulnerabilities catalog with a 12 November deadline (). GreyNoise described a group it calls GT10 deploying a backdoor called TAC Agent ().
Capabilities and access
- Vulnerable: OpenSSH before 10.6p2, on musl-based Linux, with PAM disabled (Help Net Security).
- Most exposed: Alpine's default openssh-server package. OpenWrt, Buildroot, Yocto and many Docker images also need checking (SOCRadar).
- Not affected: glibc systems. Red Hat says none of its products are affected (Red Hat).
Read the full section
- Vulnerable: OpenSSH before 10.6p2, on musl-based Linux, with PAM disabled (Help Net Security). Two account conditions also apply: at least one account has a SHA-256 or SHA-512 password hash, and a passwordless account has
*in its shadow field (Ars Technica). - Most exposed: Alpine's default openssh-server package. OpenWrt, Buildroot, Yocto and many Docker images also need checking (SOCRadar).
- Not affected: glibc systems. Red Hat says none of its products are affected (Red Hat).
Technical analysis for researchers and developers
Three choices, each reasonable when made, combine into the bug (Brain Detox): Red Hat's summary is that the server misreads whether a string is meant to be a password hash (Ars Technica). The lesson for developers: a library that signals errors with an ordinary-looking return value can silently break authentication logic built on top of it.
Read the full section
Three choices, each reasonable when made, combine into the bug (Brain Detox):
- musl, 2012:
crypt()returns*on error instead of NULL, which departs from POSIX. The reasoning was that many callers never check for failure. - OpenSSH, 2016: to fix a timing leak (CVE-2016-6210), sshd hashes every password attempt, even for accounts that don't exist or can't log in.
- Alpine, 2019–2022: locked accounts are marked with
*rather than!, because!also blocked SSH key logins.
Red Hat's summary is that the server misreads whether a string is meant to be a password hash (Ars Technica). The lesson for developers: a library that signals errors with an ordinary-looking return value can silently break authentication logic built on top of it.
Claims and evidence
- Exploit counts: Previdian first reported 8 attempts from one Japan-based IP (Help Net Security). It later reported 20 attempts from 13 IPs in nine countries (BleepingComputer).
- GreyNoise numbers changed over time: BleepingComputer reported 16 successful attack chains from six IPs. GreyNoise's live page now lists 40 attacker IPs (GreyNoise).
- Severity ratings disagree: most reports cite CVSS 8.1 (The Hacker News), while Red Hat rates it 9.8 (Red Hat).
Read the full section
- Exploit counts: Previdian first reported 8 attempts from one Japan-based IP (Help Net Security). It later reported 20 attempts from 13 IPs in nine countries (BleepingComputer). A later report put the total at 22 attempts from 14 IPs (The Hacker News).
- GreyNoise numbers changed over time: BleepingComputer reported 16 successful attack chains from six IPs. GreyNoise's live page now lists 40 attacker IPs (GreyNoise).
- Severity ratings disagree: most reports cite CVSS 8.1 (The Hacker News), while Red Hat rates it 9.8 (Red Hat).
- All of these counts come from security vendors' own honeypots and sensors.
Context and prior work
- The OpenSSH 10.6p2 announcement says the project is moving to more frequent releases. The reviewed sources do not say whether this particular bug was found with AI.
- The OpenSSH 10.6 release in October also welcomed AI-assisted bug reports, provided they come with human review (LWN).
Read the full section
- The OpenSSH 10.6p2 announcement says the project is moving to more frequent releases. The reason given is that vulnerabilities found with AI tools are being independently rediscovered by other researchers (oss-security). The reviewed sources do not say whether this particular bug was found with AI.
- The OpenSSH 10.6 release in October also welcomed AI-assisted bug reports, provided they come with human review (LWN).
Limitations, safety and contested findings
- AI-generated backdoor claim: Ars says TAC Agent appears to have been written with AI (Ars Technica).
- TAC Agent never activated: on the victims GreyNoise observed, the backdoor never finished enrolling with its server and never received a task (GreyNoise).
- Scale is unclear: Defused saw only a small number of actors trying the exploit (BleepingComputer).
Read the full section
- AI-generated backdoor claim: Ars says TAC Agent appears to have been written with AI (Ars Technica). GreyNoise's own TAC Agent write-up is labeled as LLM-generated and subject to revision (GreyNoise).
- TAC Agent never activated: on the victims GreyNoise observed, the backdoor never finished enrolling with its server and never received a task (GreyNoise).
- Scale is unclear: Defused saw only a small number of actors trying the exploit (BleepingComputer). GreyNoise notes its data covers only its own sensors, not the whole internet (GreyNoise).
Business and practitioner implications
- Patch now: upgrade to OpenSSH 10.6p2 or later and rebuild Alpine-based container images, not just running hosts.
- If you can't patch yet: set
PasswordAuthentication no(Help Net Security). - Check for compromise: look for "Accepted password" log entries on passwordless accounts, unexpected
authorized_keyschanges, and TAC Agent files (BleepingComputer).
Read the full section
- Patch now: upgrade to OpenSSH 10.6p2 or later and rebuild Alpine-based container images, not just running hosts.
- If you can't patch yet: set
PasswordAuthentication no(Help Net Security). - Check for compromise: look for "Accepted password" log entries on passwordless accounts, unexpected
authorized_keyschanges, and TAC Agent files (BleepingComputer). - Watch embedded devices: OpenWrt and Yocto devices tend to get patched slowly (SOCRadar).
The source trail.
Sources (10)
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
Article text retrieved; extracted text may omit tables or interactive elements.
arstechnica.com