On 5 November 2026, OpenSSH issued emergency release 10.6p2 to block sshole, CVE-2026-123158: on a musl-based Linux system without PAM, Alpine Linux among them, an account with no password accepts any password between 257 and 1,024 bytes long. Previdian reports a first exploitation attempt less than nine hours after the CVE was published, and root…
