Attackers have started exploiting the “SSHole” OpenSSH authentication bypass, CVE-2026-123158, against Linux systems that use the musl C library, including Alpine Linux and container hosts. GreyNoise recorded the first successful exploitation about two days after the flaw was patched.
First Successful Exploitation Came Two Days After the Patch
OpenSSH 10.6p2 fixed the flaw on November 5, and a proof-of-concept exploit appeared about four hours later. GreyNoise saw the first successful exploitation at 00:46 UTC on November 7. Reports of the activity surfaced on November 9.
The flaw stems from musl’s password hash function, which returns “*” when it hits an error. According to the research, an oversized password causes OpenSSH to treat that error value as a match for accounts that have password login disabled, granting access without valid credentials.
GreyNoise Counts 16 Successful Chains From Six IP Addresses
GreyNoise observed 16 successful exploit chains from six IP addresses. The activity went beyond simple access: attackers performed reconnaissance, queried cloud metadata services, stole SSH keys and set up persistence on compromised hosts.
TAC Agent Python C2 Tool Carries Chinese-Language Code
One attacker deployed a Python command-and-control tool called “TAC Agent,” which contains Chinese-language code. The reporting does not attribute the activity to a named group, and the language of the code is the only attribution-related detail provided.
Previdian and watchTower Report Wider Botnet and Cryptomining Links
Previdian recorded 20 exploitation attempts from 13 IP addresses in nine countries, showing the activity is not confined to one source. watchTower observed links to botnet and cryptomining operations, which match the pattern of opportunistic attackers scanning for newly weaponized flaws.
Cloud Metadata Queries and SSH Key Theft Point to Lateral Movement
The cloud metadata queries observed by GreyNoise are significant because attackers use them to retrieve credentials and instance details from cloud environments. SSH key theft and persistence indicate attackers intended to keep access and move to other systems.
Impact on Unpatched Cloud and Container Hosts With Password SSH
Unpatched cloud and container hosts that allow password-based SSH are being compromised. Because Alpine Linux is widely used as a base for containers, the musl dependency places a large population of images within the scope of the flaw.
The two mitigations in the reporting are to upgrade to OpenSSH 10.6p2 or to disable SSH password authentication. The second option removes the path the exploit relies on, since the bypass concerns accounts and logins that use password verification.
This coverage reflects a new development in a flaw reported earlier: exploitation is now confirmed. The sequence from patch to proof-of-concept to confirmed intrusion played out in two days, with the PoC appearing within hours of the fix. That gave attackers a head start over administrators who had not yet applied the update, and the observed use of the flaw for recon, key theft and persistence shows attackers moved quickly from access to follow-on activity.
Patch Window and Proof-of-Concept Timing
The sequence is short enough to measure in hours. OpenSSH 10.6p2 appeared on November 5, and a working proof of concept followed about four hours later. Exploitation reached the confirmed stage at 00:46 UTC on November 7, which is roughly two days after the patch. Previdian’s count of 20 attempts from 13 addresses in nine countries, set against GreyNoise’s 16 successful chains from six addresses, shows both failed and successful attempts.
The affected software combination is specific: OpenSSH running on musl-based Linux. The flaw depends on musl’s password hash function returning the string “*” on error, so distributions that use a different C library are outside the scope described. Alpine Linux and the container images built on it are the named examples, and GreyNoise’s observations of cloud metadata queries show attackers were already looking for cloud-hosted targets among them. The bypass applies only to accounts for which password login is disabled, which is why disabling SSH password authentication outright is listed as an alternative to patching.
