OpenSSH SSHole CVE-2026-123158: Patch Linux Servers Now

SSHole turns a failed password-hashing operation into a successful login. The sequence below follows the public technical description.

1. Find an exposed SSH service. The attacker targets an OpenSSH server running on musl with PAM disabled, such as a default Alpine Linux configuration reachable from the network.
2. Pick a password-less account. The target account is deliberately configured with no usable password, which the system marks with an asterisk (*) in the password field.
3. Send an oversized password. The attacker supplies an arbitrary password between 257 and 1,024 bytes long.
4. The hash attempt fails. The password-handling code cannot hash the oversized input, and instead of reporting an error it returns the same asterisk value that marks a disabled password.
5. The comparison succeeds. The sshd daemon compares the returned asterisk with the asterisk stored for the account, treats them as equal and grants access.

In the honeypot case described by Previdian, the attacker used oversized passwords to get in and then ran reconnaissance commands such as id, uname and hostname through non-interactive SSH sessions. That is typical first-stage behavior: confirm the access, learn the system and decide what to do next.

What can a successful attacker do? According to Safe Security, the impact depends on the privileges of the compromised account. Beyond unauthorized SSH access, attackers may reach deployment credentials, application secrets and connected infrastructure, which can enable lateral movement or service disruption. Disciplined IT managed services reduce this risk by keeping an accurate inventory, applying patches on a defined schedule and verifying the result instead of assuming it.

A clear response plan turns a headline vulnerability into a routine maintenance event. The immediate actions recommended in the reporting are straightforward.

• Patch. Install OpenSSH 10.6p2 or your distribution's patched package, then restart sshd. Restarting matters: a patched package on disk does not protect a daemon that is still running the old code.
• Hunt. Alpine advises looking in /var/log/messages for sshd lines reading "Accepted password for" on accounts that should never accept password logins, such as alpine, root or any key-only user. Review doas use and recently created users, files and authorized keys on exposed machines.
• Assume compromise when in doubt. Alpine's guidance is explicit: if you cannot rule out a login, treat the machine as compromised.
• Reduce exposure. Do not leave SSH open to the whole internet. Restrict it to management networks, a VPN or a zero-trust gateway. A well-designed multi-operator connectivity and SD-WAN architecture makes that segmentation consistent across every site and cloud.
• Remove unneeded password-less accounts. Fewer accounts with an asterisk hash means fewer ways to trigger the bug.

The business payoff is concrete. Faster patching shrinks the attack window, log review limits the damage of a missed login, and network restrictions mean the next SSH flaw is far less likely to be reachable at all. For regulated industries it also produces the evidence auditors ask for: what was exposed, when it was fixed and how it was verified.

A practical checklist for this week: inventory every host and container image running OpenSSH, identify those on Alpine or musl, upgrade to 10.6p2 or the vendor package, restart sshd, search logs for suspicious password logins and restrict SSH access to managed networks.

HIT Communications has more than 30 years of experience connecting and protecting businesses across Latin America, the United States and Europe. A flaw like SSHole needs three layers working together: fast patching, continuous detection and a network that limits exposure.

Our cybersecurity services include a 24/7 security operations center (SOC), SIEM and managed detection and response, so suspicious SSH logins are investigated as they happen and not discovered weeks later. Our IT managed services cover inventory, patching, hardening and cloud infrastructure, so updates reach servers and container images on schedule. Underneath both, our multi-operator connectivity design delivers segmented, redundant networks where administrative access is restricted by design.

We work with CIOs and IT managers who want one accountable partner instead of several vendors. If you are not certain which of your servers and containers use OpenSSH on Alpine or musl, that is the right place to begin.

SSHole shows how quickly a disclosed flaw becomes an attack: less than nine hours to the first attempt, and a growing number of attackers since. The fix is available, the exposure is limited to a specific configuration, and the cheapest time to act is now.

Upgrade to OpenSSH 10.6p2, restart sshd, review your logs for password logins that should not exist and close SSH to the public internet. If you would like help finding affected systems or building a patching and monitoring routine that does not depend on a single person, contact the HIT Communications team and we will review your environment with you.