Hackers are actively exploiting a newly disclosed OpenSSH vulnerability, identified as CVE‑2026‑123158 and nicknamed “SSHole,” to execute commands, steal credentials and establish persistent access on vulnerable Linux systems.
OpenSSH is the most widely used implementation of the Secure Shell (SSH) protocol, providing encrypted remote‑login and command‑execution capabilities for servers and workstations worldwide. Because of its ubiquity, any flaw in the software can have a broad impact across enterprises, cloud providers and individual users.
The SSHole flaw enables threat actors to run arbitrary commands on compromised hosts, harvest authentication data and create back‑doors that survive reboots. According to the advisory, the vulnerability can be leveraged remotely without prior authentication, giving attackers a direct path to take control of affected machines.
Security researchers have warned that exploitation is already underway and have urged administrators to apply the latest OpenSSH patches as soon as possible. The vendor has released updates that address CVE‑2026‑123158, and users are advised to verify that their systems are running the patched version and to review logs for any signs of unauthorized activity.
Experts continue to monitor the situation, emphasizing the importance of timely updates and robust credential management to mitigate the risk posed by the SSHole exploit.
<small>Source: Bleeping Computer — read the original story there.</small>
