Attacks against the OpenSSH flaw nicknamed SSHole have spread well beyond their first source. Threat intelligence firm Previdian says its sensors have now recorded 19 exploitation attempts from 12 unique IP addresses in eight countries, up from eight attempts from a single address in Japan when the first attacks were spotted on 6 November.

The attempts were first seen on 6 November and continued on 7 November, according to Previdian's public record for the flaw, which was updated on 8 November. The eight countries recorded are Switzerland, Denmark, Iran, Japan, the Netherlands, Norway, Singapore and the United States. The first attempt arrived less than nine hours after the vulnerability was published, and Previdian confirmed that an attacker gained root access on one of its honeypots, a decoy system running real Alpine Linux and OpenSSH.

The flaw, tracked as CVE-2026-123158 and scored 8.1 out of 10, was found by researcher Özgün Kültekin of Wakefield and fixed in OpenSSH 10.6p2 on 5 November. It affects Linux systems that run OpenSSH on the musl C library without Pluggable Authentication Modules, known as PAM, a combination that includes Alpine Linux's default OpenSSH server setup.

How an oversized password opens a locked account

The bug turns a failed password check into a successful login. On musl-based systems, the password-hashing function refuses passwords longer than 256 bytes and signals the failure by returning a single asterisk. That asterisk happens to match the asterisk stored in the password field of accounts deliberately set up with no usable password, such as root on Alpine or key-only service accounts. Send any password between 257 and 1,024 bytes long, and the server compares the two asterisks, finds them identical, and lets the attacker in.

No stolen credentials or SSH keys are needed. Previdian's founder, Ryan Dewhurst, told Help Net Security that the first attacker used oversized passwords to bypass authentication and ran reconnaissance commands, including id, uname and hostname, through non-interactive SSH sessions.

The spread to a dozen addresses in eight countries within about a day shows how quickly a published flaw is picked up once working details circulate. Proof-of-concept exploits have been posted on GitHub, though Previdian cautions that they are unverified and could contain malware.

Patch now and check your logs

The fix is OpenSSH 10.6p2, released on 5 November, and Alpine has pushed patched packages for every release from 3.16 onwards. Administrators should install the patched package and restart the SSH daemon, since an upgrade alone does not restart the running service. Until patched, disabling password authentication and using keys only removes the attack route.

Administrators should also search their logs for unexpected successful password logins, particularly entries reading "Accepted password for" involving accounts that should never accept password logins, and treat any machine with an unexplained login as compromised. The default PermitRootLogin setting blocks direct root password logins, so the more realistic route in is sideways, through another password-disabled account that can then escalate.

Previdian has added the flaw to its own list of known exploited vulnerabilities. It has not yet been added to the US CISA list of actively exploited flaws, and no confirmed compromise of a real customer system has been reported — the confirmed break-in so far is on Previdian's honeypot. Full technical details are in Previdian's vulnerability record and the Help Net Security report.