OpenSSH Issues Emergency Patch for "SSHole" Long-Password Authentication Bypass Vulnerability (CVE-2026-123158)

BleepingComputer reports multiple security firms confirmed active exploitation of SSHole (CVE-2026-123158) to run commands, steal credentials and establish persistence; GreyNoise logged the first successful exploitation on Nov 7 at 00:46 UTC. SecurityWeek reports watchTowr and Previdian saw botnet and cryptomining exploitation and advises updating to OpenSSH 10.6p2 as soon as possible. CISA added CVE-2026-123158 to KEV on Nov 9, 2026.

Source excerpt: "An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries." ^[2].

Source excerpt: "Dubbed SSHole and tracked as CVE-2026-123158 (CVSS score of 8.1), the security defect affects the OpenSSH server (sshd) on Linux distributions that use the musl libc implementation with the Pluggable Authentication Module (PAM) disabled." ^[3].

Source excerpt: "In addition, administrators should inspect SSH login logs; if an account with '*' in the password field shows an 'Accepted password' record, it should be treated as a potential SSHole exploitation attempt and investigated further for system compromise." ^[4].

“An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries.”

Trezor confirms Safe 5 hardware wallets sold by reseller CryptoBilis were fitted with recovery-phrase-stealing boards

Trezor says three Trezor Safe 5s bought from CryptoBilis contain the implant, all bought between Aug 20 and Sep 23, 2026 via CryptoBilis’s Tokopedia and Shopee stores or directly, and devices from other resellers or other models showed no tampering .