Previdian, a threat intelligence firm, said it saw attempts to exploit the OpenSSH flaw CVE-2026-123158, nicknamed "sshole", less than nine hours after it went public, The Hacker News reported. Previdian said it confirmed root access, the top level of control, on an Alpine Linux honeypot, a decoy server. The bug traces to a 2016 fix for another flaw, according to The Hacker News. An overlong password makes hashing fail and return "*". Locked accounts also store "*", so sshd lets the login through.
Previdian's page lists 17 attempts from 11 IP addresses in 8 countries, from Nov. 6 to Nov. 7. The Hacker News reported eight attempts from one IP address in Japan. Neither source says whether real systems, beyond the honeypot, were broken into.
A locked account is only locked if the check behind it works, and a 2016 fix broke that check. Exposed are key-only accounts, such as root, with a "*" hash on Alpine and other musl Linux systems without PAM. Alpine advises searching /var/log/messages for "Accepted password for" lines on accounts that should not accept passwords, and treating the machine as compromised if a login cannot be ruled out. The fix is OpenSSH 10.6p2, then an sshd restart.