Attackers are already trying to exploit a newly disclosed OpenSSH flaw, and that changes the job for anyone running Linux servers. According to The Hacker News, threat actors went after the bug within hours of its disclosure, citing security firm Previdian. The flaw can let someone sign in to accounts that have no password set, which is a serious problem on any server that exposes SSH to the internet.
TNTmax reported that Previdian said attackers had already succeeded in exploiting virtual honeypots, and that the flaw can be used to gain root access by compromising password-less accounts. That claim has not been independently verified. Even so, it moves the story from a routine patch notice to an active threat.
Our earlier coverage of the emergency OpenSSH fix for Alpine Linux servers described a password-bypass issue on the same platform. What is new is the CVE identifier, CVE-2026-123158, and the reports that attackers are using the flaw.
The OpenSSH SSHole flaw: which Linux servers are affected
The flaw is tracked as CVE-2026-123158, carries a CVSS score of 8.1, and goes by the codename SSHole. The Hacker News reports that it affects Linux systems running OpenSSH on the musl C library with PAM (Pluggable Authentication Modules) disabled. That configuration includes the default OpenSSH server setup on Alpine Linux.
Based on the reported conditions, your exposure depends on three things:
- The server runs OpenSSH linked against the musl C library, as Alpine Linux does by default.
- PAM is disabled in the OpenSSH configuration.
- At least one account has no password set, since those accounts are the reported way in.
The Cybrsecurity weekly review for Week 45 describes the flaw in similar terms, as letting attackers log into Linux accounts with passwords disabled. A Cybernews homepage headline goes further and suggests the SSH flaw reaches routers and other devices. The reporting reviewed for this story does not confirm that claim, so treat any device beyond musl-based Linux servers as unconfirmed.
Why Alpine Linux sits at the center of the risk
Alpine Linux appears often in containers and minimal server builds, which is why its default configuration matters more than the number of hosts in any single shop might suggest. Small base images get copied into many deployments. A vulnerable image can keep producing vulnerable containers until someone rebuilds it with an updated package.
OpenSSH is the standard remote login tool for Linux servers, so a server-side flaw in it carries high stakes. US system administrators, DevOps teams and hosting customers running Alpine-based containers, or OpenSSH on musl with PAM disabled, are the most directly exposed. Hosting customers often have the least control, because they depend on their provider to patch the underlying host.
The risk also depends on what an attacker gets after the first login. A root session lets an intruder change configurations, install tools, read credentials stored on the machine and move on to other systems on the same network. That is why a password-less account on an internet-facing server deserves attention even if no other weakness is known.
Exploitation claims and what remains unverified
The claim of active exploitation rests mainly on one security firm. The Hacker News and TNTmax both attribute the reports to Previdian. The sources reviewed for this story do not include a confirmation from CISA or from a vendor, so treat exploitation as reported rather than independently verified until more telemetry appears.
Several gaps remain. No count of affected or compromised servers has been published in the sources reviewed, so the scale of exposure is unknown. The CVE does not appear in the CISA Known Exploited Vulnerabilities Catalog entries that were checked, though that could change quickly. The router and device claim is unverified.
The timing is the signal that matters most. A disclosure followed by exploitation within hours leaves little room for a planned maintenance window. If a server was reachable during that gap, its authentication logs will show more than any advisory can.
How to check whether your Linux server is exposed
Start with inventory, then patch, then verify. These steps follow the reported conditions. Check them against your distribution's official advisory before you act.
- Inventory every host and container image that runs OpenSSH on Alpine or another musl-based distribution. Include CI base images, because they quietly rebuild deployments.
- Apply the OpenSSH update from your distribution or vendor, and confirm the installed version against the official advisory. The reporting reviewed here does not include a fixed version number.
- Review /etc/shadow for accounts with empty or unset password fields. Lock any account you do not need, and set strong passwords on the rest.
- Check your OpenSSH configuration to confirm whether PAM is enabled or disabled, since the reported conditions require PAM to be disabled.
- Search authentication logs for root logins or new SSH sessions you cannot account for, especially those that started after the disclosure.
- Limit SSH exposure. Put management access behind a VPN, bastion host or IP allowlist, and close public port 22 wherever you can.
If you find a session you cannot explain, isolate the host before you investigate further. Preserve logs and snapshots first, so you can establish what happened.
What to watch next
The next signal is whether CISA adds CVE-2026-123158 to its Known Exploited Vulnerabilities Catalog. A listing would turn a researcher's report into a federal priority and give agencies a remediation deadline. Its absence would not prove the attacks are fake, but it would leave the exploitation claim resting on one firm's reporting.
Also watch for distribution advisories that name fixed package versions, for independent telemetry from other security firms, and for any follow-up on the device claims. Data showing scanning against port 22 on Alpine images would help separate a targeted campaign from an opportunistic sweep.
Administrators who patch this week will be in a stronger position than those who wait for a confirmed count, because a confirmed count may arrive only after the attacks have already landed.
