A critical vulnerability in OpenSSH, a widely-used secure shell tool, has been discovered and patched urgently by its developers. The flaw, dubbed “SSHole,” allows attackers to bypass authentication and log in to affected systems using extremely long passwords.
The problem affects Linux distributions that use the musl libc implementation with Pluggable Authentication Module (PAM) disabled. Specifically, it impacts systems running OpenSSH server (sshd) on Alpine Linux, among others, where accounts like root are not properly secured. According to Özgün Kültekin, a security researcher at Wakefield, certain accounts can be accessed using any password between 257 and 1,024 characters.
The vulnerability was discovered when OpenSSH developer Damien Miller realized that the flaw wasn’t in sshd itself but could be exploited through it. Miller made this patch available in OpenSSH 10.6p2 “as fast as possible” because of recent observations of AI agents rapidly rediscovering bugs within hours. This has led to a decision to avoid long embargo periods, which mainly benefit attackers.
Alpine Linux has advised users to apply the patches immediately and restart sshd or disable password logins as a temporary mitigation if updates are not feasible. The attacker needs only to know the name of an account with no password set (which is normal for key-only accounts) and access to at least one other account with specific password hashes.
The vulnerability’s simplicity means that even basic attackers can exploit it, making every Alpine Linux deployment vulnerable if it has OpenSSH without PAM enabled, allows password authentication, and contains a local account with the specified password hash. With millions of systems worldwide exposed through open SSH ports, experts predict that scanning will begin shortly, potentially leading to widespread exploitation.
“We haven’t seen any reports of exploitation yet,” notes Fredrik Almroth, co-founder at Detectify, “but given how public these details are and how simple the attack is, I expect scanning to start within hours. The real number of vulnerable systems is likely higher than Shodan’s 22 million count since it doesn’t account for all exposed SSH ports.” WatchTowr head of threat intelligence Jake Knott echoes this concern, stating that “we’d be extremely surprised if we didn’t see SSH brute-forcers attempting this by the weekend” due to its simplicity and potential ease of exploitation.
To protect against this vulnerability, users should update their systems to the latest version of OpenSSH as soon as possible. If updates are not feasible immediately, disabling password-based authentication is a temporary mitigation that can be implemented until patches are available.
Source: SecurityWeek — 2026-11-06