Attackers are actively using the SSHole vulnerability in OpenSSH to execute commands and steal credentials on Linux systems. The flaw allows bypassing authentication on musl-based systems where password hashes are set to an asterisk. OpenSSH maintainers released a fix in version 10.6p2 on November 5, but exploit code appeared shortly after. GreyNoise recorded the first successful in-the-wild exploitation on November 7, with attackers attempting to establish persistent access. Administrators are advised to update OpenSSH immediately or disable SSH password authentication on affected systems.
Read the full story at bleepingcomputer.com.
