OpenSSH Vulnerability Exploited Within Hours: What Alpine Linux Users Must Do Now

A serious OpenSSH vulnerability is under active attack, and hackers started exploiting it less than nine hours after it went public. The flaw, tracked as CVE-2026-123158 and nicknamed “sshole,” lets attackers log into certain Linux systems without knowing any password. Alpine Linux, one of the most popular systems for Docker containers and cloud servers, is the main target.

If you run servers or containers on Alpine or other lightweight Linux systems, you should act now. Here is what happened, who is affected and how to fix it.

What Is the OpenSSH Vulnerability?

OpenSSH is the software most servers use for secure remote logins. Because of this, a flaw in OpenSSH can put millions of machines at risk.

This particular bug affects OpenSSH versions before 10.6p2 on Linux systems that use the musl C library and do not check passwords through PAM. Alpine Linux’s default openssh-server package fits that description. As Alpine’s security advisory puts it: “An attacker who can reach your SSH port can log in without knowing any password.”

The OpenSSH team released version 10.6p2 with a fix on November 5, 2026. On the same day, Alpine pushed patched packages for every branch from version 3.16 onwards.

How the Exploit Works

The bug comes from two old design choices that clash in a dangerous way.

First, many accounts are meant to have no password at all. These include the root account, users who only log in with SSH keys and default cloud users. On these accounts, the password field simply contains a “*” symbol.

Second, back in 2016, OpenSSH changed how it handles these accounts to stop attackers from guessing valid usernames through timing. Since then, when an account has no usable password, OpenSSH borrows another account’s settings and checks the password anyway.

Here is where musl comes in. Since 2012, musl’s password function has rejected very long passwords and returned a “*” symbol when it fails. Unfortunately, that output matches the “*” stored for passwordless accounts. As a result, OpenSSH sees a match and lets the attacker in.

In practice, an attacker only needs to send an extremely long password. According to Help Net Security, three conditions must be true for the attack to work:

• Password logins are enabled, which is the OpenSSH default
• An account has only “*” in its password field
• Another local account has a real password

Who Is Affected by the OpenSSH Vulnerability?

The main risk falls on Alpine Linux, which powers many Docker images and cloud servers. Researchers also named Alpine’s tiny-cloud images for AWS and Azure, versions 3.18.11 to 3.24.3, as affected.

Other musl-based systems may also be at risk. These include OpenWrt, which runs many routers, along with Buildroot, Yocto and a large number of Docker images. For this reason, administrators should check every system built on musl.

On the other hand, many common systems are safe. According to the researcher, Debian, Ubuntu and Fedora are not affected because they use a different C library called glibc. Likewise, systems that use PAM, the Dropbear SSH server and OpenBSD are not affected.

Exploited Within Hours

Security researcher Özgün Kültekin discovered and named the flaw. Interestingly, he said he used “agent swarms” of AI tools in his research. In total, he tested many versions of OpenSSH with about 17,600 unusual login attempts. Only the musl build without PAM accepted logins it should have refused.

Attackers moved fast once the details went public. Security firm Previdian recorded the first attack attempt less than nine hours after the CVE was published. Founder Ryan Dewhurst explained that the bug “was particularly trivial to exploit, which significantly shrunk that timeline.”

Since then, the activity has grown. According to Previdian’s tracking page, its sensors recorded 20 attempts from 13 unique IP addresses in nine countries between November 6 and 8. The attackers ran basic commands to learn about the systems they reached. Previdian also confirmed that the exploit gave root access on a test system running real Alpine Linux and OpenSSH.

Previdian rates the flaw 8.1 out of 10 for severity. Meanwhile, proof-of-concept exploit code has appeared on GitHub. However, Previdian warns that this code is unverified and may itself contain malware.

How to Fix It Now

OpenSSH developer Damien Miller did not mince words. He urged admins of affected systems to “stop reading and set PasswordAuthentication=no or disable SSH for these systems IMMEDIATELY.”

Here are the steps to take:

• Update OpenSSH to 10.6p2. On Alpine, run the package upgrade for openssh.
• Restart the SSH service. This step is critical. Updating alone does not replace the running SSH process, so the old flaw stays open until you restart it.
• Disable password logins. If you cannot update right away, set PasswordAuthentication to “no” and restart SSH. Use SSH keys instead.
• Check your logs. Look for “Accepted password for” entries on accounts that should never use passwords, such as root or key-only users.
• Review recent changes. Check for new user accounts, changes to authorized_keys files and unusual admin activity.

Finally, if you cannot rule out a break-in, treat the system as compromised. In that case, rebuild it from a clean image rather than trying to clean it.

A Wider Lesson for Security Teams

This case shows how quickly the gap between disclosure and attack is shrinking. Attackers now scan for new flaws within hours, and AI tools help both defenders and criminals move faster. For example, ransomware gangs are already using AI to break into networks, as we explain in our report on ransomware AI agents.

As a result, patching on a monthly schedule is no longer enough for internet-facing systems. Teams need fast alerts, quick testing and the ability to apply urgent fixes within hours. Our guide to AI-powered cyberattacks in 2026 explains why speed now matters more than ever.

The Bottom Line

The OpenSSH vulnerability CVE-2026-123158 is easy to exploit, and attackers are already using it. If you run Alpine Linux or other musl-based systems, update to OpenSSH 10.6p2, restart SSH and turn off password logins today. Above all, remember that an update only protects you after the service restarts.