decrypted · 10 november 2026 · vulnerabilities and patching · uk policy and law · ai and llm security

SSHole: an OpenSSH login flaw that treats an error as a yes

A lock that opens when it cannot work out the answer is not a lock. That is the short version of SSHole, a flaw in OpenSSH, the program behind SSH, the encrypted way administrators log in to servers. It is tracked as CVE-2026-123158, and CISA added it on 9 November to its KEV list, the flaws known to be exploited in real attacks. OpenSSH shipped the fix, version 10.6p2, on 5 November. Exploit code was public within hours, and the first successful break-ins followed within two days.

What actually went wrong

On Linux, a locked account stores a single asterisk where its password hash would be, meaning no password can ever match. The trouble is on systems using the musl C library, which includes Alpine Linux, a common base for containers. Hand musl's hashing routine an absurdly long password and it fails, and it reports that failure with the same asterisk. OpenSSH then compares the asterisk with the asterisk and concludes the guest is on the list.

Think of a doorman told that a blank line on the guest list means nobody may enter. When his clipboard jams he reads out "blank", the visitor says "blank" back, and in he walks. Previdian describes the affected setup as OpenSSH before 10.6p2 on Linux with musl and without the optional login layer, where a password between 256 and 1024 characters succeeds for some account configurations.

What the attackers did

GreyNoise recorded the first public exploit on 5 November and the first successful exploitation just before 1am UTC on 7 November. Its dashboard counts 18 confirmed post-exploitation sessions from six addresses. Previdian saw 21 attempts from 13 addresses in nine countries. Small beside the tens of millions of ordinary SSH attempts GreyNoise logged, but the flaw is trivial to use. One cluster dropped a Python runtime and an implant called TAC Agent, which GreyNoise says never registered with its control server.

What a defender sees

A successful password login to an account that should never accept one is the tell. Check for accounts with an asterisk in /etc/shadow, then look for password logins to them, new SSH keys and unfamiliar startup services. The fix is to update to 10.6p2 or switch off SSH password logins entirely, which is a one-line change and the better habit anyway.

The Secure by Design lesson

This is opinion, not advice, but the design error is old: an error value and a legitimate value that look identical. A security check must fail closed, so that "I could not compute an answer" can never be mistaken for "yes". Storing a placeholder in the same field as real data invites exactly this confusion.

The cost is modest. Inventory the container images you pull from the internet, rebuild the Alpine-based ones on a patched version, and stop admins holding passwordless root over SSH. A key-only login has no password check to bypass.

Also this week

The NCSC says the cheap-tech bill is due. The National Cyber Security Centre, part of GCHQ, launched its annual review on 3 November, judging it highly likely that AI-powered malware will be used in a ransomware attack on Britain's critical national infrastructure by 2028. The sharper point is in remarks prepared for chief executive Richard Horne: the danger is not that AI has invented new ways to attack us, but that weaknesses tolerated for years can now be found and exploited at scale. His line for boards was that "for decades, we have collectively got away with doing tech on the cheap". The NCSC urged organisations to invest properly in their technology and to avoid connecting things to the internet unnecessarily. That is a budget decision, not a technical one.

A German host and an AI assistant's front door. The Record reported on 9 November that Mittwald, a German hosting provider for web agencies, said attackers compromised 56 customer projects after going undetected for eight days. The way in was a flaw in its MCP server, short for Model Context Protocol, a standard for plugging AI assistants into other tools. The company's managing director said logs showing steps seconds apart suggested AI tooling, but offered no other evidence, so treat that as a claim. The design lesson holds either way: each new route by which an assistant can act for a customer is a new front door, and it needs the same authorisation checks as the old ones. No UK link has been stated.

A supplier said all was well, then it was not. Sega said on 9 November that unauthorised access to the mail-delivery service run by its contractor Arara exposed 2,196,044 email addresses, 92,273 of them with delivery-related information. Names, card details and passwords were not involved, and Sega has not confirmed any misuse. Arara told Sega on 29 October that nothing had leaked, then disclosed the intrusion on 1 November. Sega's statement names no UK link, but the lesson travels: write into supplier contracts how fast, and how plainly, they must tell you.

Sources

If you want help working out what your own exposure looks like, get in touch.