Previdian says attackers obtained root access on an Alpine Linux honeypot by exploiting SSHole, adding an observed attack to a vulnerability previously documented through advisories and proof-of-concept work. The report increases the urgency for exposed administrators, while leaving an important boundary: the confirmed access described by the company involved its honeypot.
In a November 6 interview with Help Net Security, Previdian founder Ryan Dewhurst said the first attempt arrived less than nine hours after the CVE was published. He reported successful root access on a system running Alpine Linux and OpenSSH, followed by reconnaissance commands through non-interactive SSH sessions.
The company’s public vulnerability page, checked on November 7, now lists 19 attempts from 12 source IP addresses across four sensors. Those are attempt counts, not a tally of compromised servers. Previdian explicitly says its sensor observations do not establish that a target was vulnerable or that an attempt succeeded.
These findings extend DaySec’s earlier coverage of the Alpine authentication bypass. They provide a concrete reason to investigate exposed hosts alongside patching, without establishing widespread compromises of production systems.
Root access depends on the account and configuration
CVE-2026-123158 affects specific Linux deployments using musl libc without PAM-based password checking. Alpine’s advisory says exploitation requires password authentication to be enabled, a target account whose password field is an asterisk, and another local account with a SHA-256 or SHA-512 password hash.
The flaw does not automatically turn every login into root access. Alpine says the default restriction on root password login protects that account unless changed. Another reachable account may still offer a route to elevated privileges: certain official tiny-cloud images include an alpine user with passwordless doas, subject to the advisory’s other prerequisites.
Review earlier access as well as the installed package
OpenSSH 10.6p2 supplies a workaround, and Alpine publishes patched revisions for its distribution branches. Administrators must restart sshd after upgrading. If patching must wait, Alpine recommends disabling password authentication and restarting the service, after confirming that key-based access works.
Alpine also recommends investigating successful password logins to accounts intended to accept only keys, along with unexpected doas activity, new users, files and authorized keys. If unauthorized login cannot be ruled out, its guidance is to treat the machine as compromised.
