Hackers actively exploit SSHole flaw in OpenSSH to breach Linux systems

· Cybersecurity

Attackers are actively exploiting a vulnerability dubbed "SSHole" (CVE-2026-123158) in OpenSSH, the widely used remote login software for Linux and other Unix-like systems, to execute commands, steal credentials and establish persistent access. Initial exploitation attempts have been attributed to botnets and cryptocurrency miners, but researchers expect other threat actors to follow as proof-of-concept code spreads. A successful authentication bypass in OpenSSH is especially dangerous because the software guards administrative access to a large share of servers and network equipment. Operators are advised to patch promptly and to watch for signs of unauthorized access.

Why it matters：OpenSSH underpins administrative access across servers and network devices, so an exploitable authentication bypass raises breach risk for nearly every organization running Linux infrastructure.

Key points

  • The flaw is tracked as CVE-2026-123158.
  • Botnets and crypto miners are behind the first exploitation attempts.
  • Researchers expect broader exploitation as more attackers pick up the exploit.

Sources (original reporting)

More stories from this day