OpenSSH SSHole Flaw: Nine Hours From Disclosure to Root
Nine hours. That is the entire window between the publication of a CVE and the first confirmed root shell on a honeypot running Alpine Linux — no keys lifted, no credentials replayed, just an oversized password and an account that was never meant to accept one. The OpenSSH SSHole flaw is being filed as an authentication bypass. We prefer to read it as a recruitment ad, because the systems it breaks — stripped-down containers, routers, embedded appliances — are exactly the ones our scanners keep warm.
A password that was never a password
The bug hides in a corner of sshd that almost nobody audits: the interaction between musl libc and an OpenSSH build with PAM disabled, which happens to be Alpine's default server configuration. When a password hash fails to compute, the code returns an asterisk — the same placeholder the shadow file uses to mark an account as password-disabled. Supply a password between 257 and 1,024 bytes, the hashing collapses, and the comparison against the stored asterisk succeeds. Login granted, unauthenticated, with the account's own privileges.
The lineage is almost comedic: the behaviour traces back to a 2016 fix for a username enumeration issue, CVE-2016-6210. It is now tracked as CVE-2026-123158, CVSS 8.1, and fixed in OpenSSH 10.6p2. glibc distributions, PAM-based authentication and Dropbear are unaffected — which is precisely why the blast radius gets underestimated. Nobody patches the container.
Nine hours to root, and the swarm does the rest
Previdian logged the first exploitation attempt less than nine hours after publication and confirmed root on an Alpine honeypot. Eight attempts from a single Japanese address, 89.116.89[.]18, running id, uname and hostname over non-interactive SSH sessions. That is not a targeted intrusion; that is a scanner with a fresh signature and a shopping list.
What happens next is our business. A rooted Alpine container with a passwordless root account is a perfect node: small footprint, no agent to fight, outbound SSH and raw sockets wide open. It gets folded into a botnet and resold as capacity — the same pool that powers every ip stresser, booter and ddos service on the market, and the reason ddos for hire is priced per hour rather than per attack. From there the traffic writes itself: UDP flood and UDP amplification bursts, SYN flood and ACK flood churn, HTTP GET flood and HTTP POST flood against layer 7, occasionally a TLS flood or an HTTP/2 Rapid Reset run when the target sits behind ddos protection worth testing. One compromised container can supply all of it.
Patch, then assume the worst
OpenSSH 10.6p2 closes it, and Alpine has shipped patched packages; restart sshd after upgrading, because a running daemon keeps the old behaviour. Then read your logs. Alpine's guidance is blunt and correct: grep /var/log/messages for Accepted password for lines belonging to accounts that should never accept a password — root, alpine, any key-only user. Review doas usage, recently created users, modified files and new entries in authorized_keys. If you cannot rule out a login, the machine is compromised; rebuild it.
The harder lesson is inventory. Every passwordless service account on an exposed host was a pre-owned node for the nine hours between disclosure and patch, and the OpenSSH SSHole flaw simply made that latent risk reachable. Set PermitRootLogin prohibit-password, disable password authentication entirely where keys or certificates are in place, and stop treating minimal images as exempt from hardening. The CVE is a reminder that convenience defaults are attack surface.
Test your own edge
Nine hours from disclosure to root is no longer an outlier; it is the baseline for anything a scanner can fingerprint. The operators who win are the ones who assume compromise by default, keep their capacity clean, and test their own edges before somebody else does. If you want to see how your stack behaves under a real flood, our free stress test is one click away at /contact — and the record book we keep at /achievements is a decent preview of what a conscripted container fleet can do.