Within hours of its public disclosure, attackers began probing a new OpenSSH flaw dubbed SSHole (CVE-2026-123158, CVSS 8.1). Researchers at Previdian say the bug lets someone log into an account that technically has no password set, on Linux systems running OpenSSH against musl libc with PAM authentication turned off — and one attacker already rode it to root access on a monitoring honeypot. It's a reminder of how quickly opportunistic scanning follows disclosure for auth-bypass bugs on internet-facing SSH servers.
// source: thehackernews.com ↗