Hackers actively exploit the SSHole OpenSSH flaw to breach Linux systems

Summary

Hackers are actively exploiting a flaw in OpenSSH nicknamed "SSHole", tracked as CVE-2026-123158, to execute commands, steal credentials and establish persistent access on Linux systems, according to BleepingComputer. Ars Technica separately reports that the vulnerability, which lets hackers SSH into Linux devices, is under active exploitation and describes SSHole as a serious threat to Internet security. The available reports do not give affected versions or the scale of the attacks.

Timeline

1. BleepingComputer

   9 Nov 2026, 16:04 UTCSource ↗

   BleepingComputer reports that hackers are actively exploiting the "SSHole" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials and establish persistent access.

2. Ars Technica

   9 Nov 2026, 19:41 UTCSource ↗

   Ars Technica reports that a vulnerability that lets hackers SSH into Linux devices is under active exploitation, and describes the "SSHole" flaw as a serious threat to Internet security.