OpenSSH SSHole Flaw Is Under Active Attack as CISA Adds It to Its Exploited List

A high severity OpenSSH flaw nicknamed SSHole, rated 8.1 out of 10, is being exploited in the wild just days after a fix shipped. According to SecurityWeek, it affects the OpenSSH server on Linux systems that use the musl C library with PAM disabled, which includes the default setup on Alpine Linux. Help Net Security says the fix arrived in OpenSSH 10.6p2 on November 5 and attacks began within hours. Threat intelligence firm Previdian counted 20 exploitation attempts from 13 attacker addresses in 9 countries between November 6 and 8, and BleepingComputer reports attackers are running commands, stealing credentials, and setting up persistent access. CISA added the flaw to its exploited vulnerabilities list on November 9. Admins should upgrade, or disable password authentication until they can. For more, visit BleepingComputer.