Security AlertCritical
Hackers are exploiting the OpenSSH SSHole flaw on Linux systems
Nov 9, 2026 · Summarized by Fundy Tech from 4 sources
The 30-second version
Hackers are actively exploiting the SSHole flaw in OpenSSH to get into some Linux systems. The fix is available, and users should update and check for unusual login activity.
Key points
- CVE-2026-123158 affects certain musl-based Linux systems, including Alpine.
- Attackers can steal credentials, run commands, and keep persistent access.
- OpenSSH 10.6p2 fixed the bug on November 5.
- GreyNoise saw successful exploitation in the wild on November 7.
Why it matters
If you run Linux servers or hosted services, this could expose login credentials and system access. Small businesses should patch quickly and review logs for suspicious SSH activity. Households with self-hosted devices should also update if they use affected software.
Who’s affected: Certain musl-based Linux systems running OpenSSH
What to do
- Update to OpenSSH 10.6p2 or later.
- Disable password authentication if you can.
- Check logs for unusual SSH logins.
- Review root and authorised_keys access.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.