SSH vulnerability lets hackers into Linux
The gist
Security researcher Ozgun Kultekin disclosed an OpenSSH flaw letting attackers log into some Linux systems without a password.
Alpine Linux, OpenWrt and Buildroot users should patch; Debian, Ubuntu and Fedora are unaffected.
How it unfolded
- 2016A patch fixing the OpenSSH username enumeration flaw CVE-2016-6210 changed how OpenSSH handled accounts without usable password hashes, performing password hashing even when an account had no usable hash — the origin of the flaw.
- Nov 5, 2026Security researcher Ozgun Kultekin discovered and released details on the vulnerability, dubbed "*sshole" and tracked as CVE-2026-123158, after AI agents ran about 17,600 authentication tests.
- Nov 5, 2026OpenSSH released version 10.6p2 to address the password authentication bypass, and Alpine Linux released fixes the same day.
Key terms
- OpenSSH
- A suite of secure networking utilities based on the SSH protocol that provides encrypted communication over insecure networks.
- musl
- A lightweight C standard library for Linux-based systems, released under the MIT license and aimed at embedded and mobile devices.
- C library
- The standard library of functions and headers specified by the ISO C standard for the C programming language.
Source: Wikipedia