Hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH on musl-based Linux systems such as Alpine, allowing them to bypass authentication and execute commands. The flaw lets attackers log in when the password hash in /etc/shadow is set to an asterisk (*) because an oversized password triggers musl’s hashing function to return * on error, which OpenSSH mistakenly treats as a match. Exploitation attempts began on November 5, the day a proof-of-concept exploit was released, with the first successful wild exploit recorded on November 7 at 00:46 UTC, about 40 hours after the fix. OpenSSH maintainers released version 10.6p2 on November 5, but GreyNoise observed 16 successful exploitation chains from six source IPs, and Previdian saw 20 attempts from 13 IPs in nine countries. Researchers noted attackers performed system and container reconnaissance, queried cloud metadata, read password hashes and root SSH keys, and tried to modify authorized_keys to gain persistence, with one case installing a Python TAC Agent that failed to contact its C2 server. 1