Attackers gained root access on a honeypot in under nine hours, before many teams had patched.
The Hacker News reports that attackers began exploiting a newly disclosed OpenSSH flaw, tracked as CVE-2026-123158 and codenamed SSHole, within hours of its publication. The CVSS 8.1 bug affects Linux systems running OpenSSH on the musl C library with PAM disabled, a configuration that includes Alpine Linux's default SSH server setup. Threat intelligence firm Previdian said it observed the first exploitation attempt less than nine hours after the CVE went public, and confirmed attackers achieved root access on a honeypot running Alpine Linux and OpenSSH. The issue, found by researcher Ozgun Kultekin, is fixed in OpenSSH 10.6p2.
Non-Linux systems, Linux builds on glibc, and systems that verify passwords through PAM are not affected, according to OpenSSH's Damien Miller. Affected teams are advised to install OpenSSH 10.6p2 or their distribution's patched package and restart sshd, then check logs for "Accepted password" entries tied to accounts that have no password set, such as alpine, root or key-only users.
Why it matters: Alpine's minimal footprint makes it a default base image across containers and cloud infrastructure, so a flaw exploited this fast in the wild is a reminder to patch SSH-facing systems on disclosure, not on a routine cycle, and to audit which base images rely on musl with PAM disabled.