Blank Passwords Let Attackers In: OpenSSH Flaw 'SSHole' Is Already Being Targeted

Attackers are trying to exploit a recently disclosed weakness in OpenSSH, the widely used tool for remotely logging in to Linux servers. The flaw, tracked as CVE-2026-123158 and nicknamed SSHole, has a severity score of 8.1. It can allow someone to sign in to an account that has no password set.

Not every system is affected. The issue impacts Linux systems running OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled. This includes the default OpenSSH server configuration in Alpine Linux. As of November 9, 2026, 20 exploitation attempts had been recorded from 13 unique IP addresses across Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland and the U.S.

The flaw was the lead item in The Hacker News weekly recap, which noted that a system does not always need a complicated bug to let someone in. The recap also pointed to a broader pattern: attackers are using old mistakes, forgotten settings and small changes made months earlier, while the gap between a patch being released and an exploit appearing keeps shrinking. This article covers only the opening of that recap, so other stories in it are not summarised here.