THE ESSENTIALS IN 30 SECONDS

  • OpenSSH 10.6p2, released November 5, works around a flaw that let passwords of 257 to 1,024 characters log into accounts with no password on musl systems without PAM.
  • Discoverer Özgün Kültekin of Wakefield says he used AI agent swarms in his research, per Help Net Security; OpenSSH's Damien Miller said AI agents now rediscover bugs within hours.
  • Threat intelligence firm Previdian says it saw exploitation less than nine hours after the CVE was published.

The OpenSSH project shipped an emergency release, version 10.6p2, on November 5 to block an authentication bypass affecting Linux systems built on the musl C library, such as Alpine Linux. The issue, nicknamed "sshole" by its discoverer Özgün Kültekin of the testing firm Wakefield, let an attacker log into accounts that are supposed to refuse passwords, including root and key-only users.

How the bypass works

On musl, the crypt() function returns an asterisk when a password is longer than 256 bytes. An asterisk is also what many systems store in the password field of accounts that have no password. When sshd compared the two, it saw a match and accepted the login. According to The Hacker News and CSO Online, exploitation requires sshd built or run without PAM, password authentication enabled (the default), a known account with an asterisk in its password field, and at least one other account with a real password hash. Alpine's default openssh-server package meets the first condition. CSO reports that on some Alpine cloud images the default user has passwordless doas rights, which lets an attacker reach root.

OpenSSH describes the change as a workaround and places the root cause outside sshd. Glibc-based distributions such as Debian, Ubuntu and Fedora, and setups that use PAM, are reported as unaffected. Alpine has published fixed packages, and administrators who cannot update can set PasswordAuthentication to no. Help Net Security and CSO identify the flaw as CVE-2026-123158; The Hacker News said no CVE had been assigned when it reported the fix.

Where AI comes in

According to Help Net Security, Kültekin said he used AI "agent swarms" during his research and testing; he has not been reported as saying the AI found the bug on its own. On the defensive side, OpenSSH's Damien Miller said, as reported by The Hacker News, that the team has recently seen AI agents independently find the same bugs again, sometimes within hours, which he gave as a reason long embargoes are risky and the fix shipped fast.

Attackers moved quickly too. Help Net Security reports that Previdian detected a first attempt less than nine hours after the CVE was published and that an Alpine honeypot was compromised with root access. Its founder, Ryan Dewhurst, said attackers are getting faster with AI's help. Earlier reports from November 5 had found no sign of attacks, and the scale of exploitation beyond Previdian's sensors is not known.