Attackers are exploiting the “SSHole” flaw in OpenSSH to break into some Linux systems, according to a BleepingComputer report published November 9, 2026. The report says the flaw is tracked as CVE-2026-123158 and is fixed in OpenSSH 10.6p2, released November 5.

Who has seen exploitation

  • Finnish security company Defused observed exploitation attempts over a weekend and reported “a small amount of actors” trying to exploit the flaw, not widely, according to BleepingComputer.
  • Threat-intelligence firm GreyNoise recorded the first successful exploitation in the wild on November 7 at 00:46 UTC, about 40 hours after the fix, according to the report. GreyNoise logged 16 successful exploitation chains from six source IP addresses and said they were “not representative of the broader activity involving SSHole.”
  • Network-security firm Previdian saw 20 attempts from 13 attacker IP addresses in nine countries and confirmed successful exploitation, according to BleepingComputer.
  • Offensive-security firm watchTower said on November 6 that it observed exploitation tied to botnet and cryptomining activity, according to the report.

What attackers did, according to GreyNoise

BleepingComputer reports that attackers ran system and container reconnaissance, queried cloud metadata services, tried to read password hashes and root SSH keys and tried to modify authorized_keys files for persistence. One attacker gained root and installed TAC Agent, a Python command-and-control implant that never received a task because it could not reach its server. GreyNoise says the implant’s comments, logs and errors were in Chinese, which may help determine origin, and that some signs suggest automated operation. The article does not name the attackers.

Who is affected

The report says the flaw affects OpenSSH on certain musl-based Linux systems, including the Alpine distribution used in cloud and virtual environments. Exploitation requires accounts whose password hash is set to an asterisk to block password logins; accounts with valid password hashes are not affected. Root access is possible where the account has passwordless administrative privileges. BleepingComputer does not give a vulnerable version range or a CVSS score.

What administrators are advised to do

According to the report, administrators should update OpenSSH to version 10.6p2 or disable SSH password authentication, and should check for unexpected successful password logins on accounts with an asterisk in the /etc/shadow password field, unauthorized SSH keys, and TAC Agent files or startup services.

Sources and notes

This post is based on BleepingComputer’s article by Bill Toulas, published November 9, 2026. Lens did not read the reports from Defused, GreyNoise, Previdian or watchTower, or the OpenSSH advisory, so their findings are as BleepingComputer described them. Lens did not test the flaw or contact the firms.

Image: Network and power cabling at the back of a server rack, by RobH via Wikimedia Commons, released under CC BY-SA 3.0; cropped. Stand-in photo; it does not show the events described.