# Vulnerability that lets hackers SSH into Linux devices is under active exploitation

> **Open Intelligence Dossier** · First detected: 2026-11-09 20:40 UTC · Category: Technology

## Executive Summary
An OpenSSH authentication bypass dubbed SSHole is under active exploitation on Alpine Linux systems.

## Intelligence Brief
Coverage from Korben and SecurityWeek reports that a vulnerability in OpenSSH is under active exploitation, allowing attackers to SSH into Linux devices using any password. Korben's reporting describes the flaw as letting anyone in with any password on Alpine Linux, while SecurityWeek identifies the issue as an authentication bypass tracked under the name SSHole. The coverage does not yet specify which versions of OpenSSH are affected, how many systems have been compromised, or who is behind the exploitation.


The coverage emphasizes that this is not merely a theoretical vulnerability but one already being exploited in the wild. SecurityWeek frames the story around active hacker exploitation of the SSHole authentication bypass, while Korben focuses on the practical consequence: unauthorized SSH access to Alpine Linux devices.


OpenSSH is a widely used suite of tools for secure remote login and network services, and Alpine Linux is a lightweight distribution commonly deployed in containers, servers, and embedded environments. An authentication bypass in this context means an attacker could gain remote shell access without valid credentials, potentially moving laterally within networks or using compromised devices as jump hosts. The coverage does not state whether a patch is available, whether Alpine Linux has issued an advisory, or what the specific root cause of the bypass is.


Readers should watch for official advisories from OpenSSH maintainers and Alpine Linux maintainers, patch availability, and any further reporting on the scope of exploitation. The coverage does not indicate whether the vulnerability has been assigned a CVE identifier, whether remote code execution is possible beyond initial access, or whether exploitation is limited to specific configurations. Until those details emerge, the precise exposure for individual systems remains unspecified by the current reporting.

## Multi-Source Evidence Table
| Source Outlet | Headline | Verification URL |
|---|---|---|
| Cybernews | SSHole Linux login flaw actively exploited: any password over 256 characters works | [Source Link](https://news.google.com/rss/articles/CBMifEFVX3lxTE04MEJnelIyZnc4WG5TRGVuQ1NzNTYyTnlhUVNJT1pmcEFEVUtHMEViRDROVEpqSS04Q3hEMmViOWw2Z0pCWEFkNmZxM05vVFo2OGF1NjZGdlN1RXJJZ0NaOEdKOGNUV3JiMnljUnBwWHhaZUxHdno0R3c2LVg?oc=5) |
| shattered.io | Tailscale SSH: Close Port 22 in 12 Steps, 60 Min [2026] | [Source Link](https://news.google.com/rss/articles/CBMicEFVX3lxTFBJbzJNNTNjdXE0TnFxVUJZSzRUMVY3RXFrN18wMHhxR0phNi0xNWFTWms5SzFPOGhCd0ZscXhUTkFEdUhSVGEwOWpZTGlpYUJtWWJESUREaDVzendDaW9hRXVLNm9kTGFObWJCSlpVRWw?oc=5) |
| Korben | OpenSSH let anyone in with any password on Alpine Linux | [Source Link](https://news.google.com/rss/articles/CBMihwFBVV95cUxQRXFVMm9RempaNEhvVDdEVzRnRUtBVTJBeWJtVkpjTTVwcnhDejlUVUJFQjNNNmVIMGxXRWNDV2ZpSzhTeTVFOGpKNzg2ZTRQMVVuaDNWWThzeV90MUlDSGVUT0VvWjRjVnd5akVIUklXTlFBcDNuek5FVnlEZks3YjJrYmMyOHM?oc=5) |
| SecurityWeek | Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH | [Source Link](https://news.google.com/rss/articles/CBMikgFBVV95cUxNaktFcC1GZnU5eDRrdkF2QVhXUjVPaGtUVXowUGNYSVlCdDRzSG8zRFRKeXk4VllJc2RLYVpqdE9tSkd5SHBHRVNPWDBlU2JXdGVKTnRjRl9idldENlFITjh1UTJ1SkEtRkptUjNEZzRFa1hjdkY4dEd2bTlUYjZzQmN3NGx5OFgtbWpScVVyUGxkZw?oc=5) |

---
*Canonical Source: https://pulse.byoaiapps.com/trend/2026-11-09/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under-active*