# Meet *sshole, the vulnerability that lets hackers SSH into Linux devices

- URL: https://talkfuse.com/story/meet-sshole-the-vulnerability-that-lets-hackers-ssh-into-linux-devices/
- Published: 2026-11-05T23:09:36+00:00
- Updated: 2026-11-06T00:27:34+00:00
- Original publisher: Ars Technica
- Original article: https://arstechnica.com/security/2026/11/vulnerability-allows-attackers-to-log-into-some-linux-devices-sans-password/
- Topics: Cybersecurity, Technology

## Key points

- *sshole can bypass SSH passwords in certain Linux configurations.
- Alpine and OpenSSH have released updates.
- The vulnerability’s reach beyond Alpine is still unclear.

## Summary

A vulnerability dubbed *sshole can let an attacker log into some Linux devices over SSH without knowing a password. It matters because Alpine Linux is widely used in embedded devices, servers and containers, and some affected devices may be difficult to update.

Exploitation requires OpenSSH with musl and no PAM, an active account with a SHA256- or SHA512-hashed password, and a target account configured as passwordless. An attacker can then enter a password longer than 256 characters; the maintainers say one connection is enough. Alpine and OpenSSH have issued updates, but the scope beyond Alpine remains uncertain; Shodan lists about 22 million systems with SSH open, only a fraction of which are expected to meet the conditions.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.