On Nov 5, OpenSSH released version 10.6p2 to fix a password authentication bypass nicknamed "SSHole" (CVE-2026-123158, CVSS 8.1), per the OpenSSH release notes and the oss-security disclosure. Exploit code showed up a few hours later, and by the weekend GreyNoise, watchTowr and Previdian were all reporting attacks in the wild, per BleepingComputer and SecurityWeek.

What the flaw does. Some accounts, like root on Alpine, are set up so they can never log in with a password; their stored password is just an asterisk. On Linux systems that use the musl C library with PAM turned off, sending a password longer than 256 characters makes musl's hashing function fail and return an asterisk. OpenSSH then sees that it matches and lets the attacker in. Accounts with real passwords are not affected, and neither are glibc-based distributions, systems using PAM, or the Dropbear SSH server, per Astra Security.

What attackers are doing with it. GreyNoise logged its first successful break-in on Nov 7. Attackers looked around the system and containers, queried cloud metadata services, tried to read password hashes and root SSH keys, and added their own SSH keys to keep access. In one case they got root and installed a remote-control program called TAC Agent. watchTowr says only botnets and crypto miners have picked it up so far.

Why small businesses should care. You may not think you run Alpine Linux, but it is common inside cloud servers, Docker containers and appliances, and OpenWrt and Yocto show up in routers and embedded devices. If a contractor or vendor set up a small server, VPN box or device for you, it could be one of them. Anything with SSH open to the internet is getting scanned right now.

Action item: Check anything that runs SSH this week.
1. Find your SSH systems. List servers, cloud instances, containers and network devices that accept SSH, especially anything reachable from the internet. Ask your vendor if you're not sure what an appliance runs.
2. Update OpenSSH. Install OpenSSH 10.6p2 or your distribution's patched package. On Alpine, run apk upgrade openssh. Upgrading doesn't restart the running SSH service, so restart it afterward.
3. Can't patch yet? Turn off SSH passwords. Set PasswordAuthentication no in /etc/ssh/sshd_config and restart SSH. Confirm key-based login works first so you don't lock yourself out.
4. Look for signs of a break-in. Check SSH logs for successful password logins to accounts that shouldn't have one, look for SSH keys you didn't add in authorized_keys files, and check for unfamiliar startup services.

Not sure what's running SSH on your network? Call us at +1 (689) 225-0286.