sshole: the OpenSSH bug that lets a long password open an account with no password
On 5 November 2026 the OpenSSH project shipped an emergency release, OpenSSH 10.6p2, to close a password authentication bypass. The researcher who found it, Özgün Kültekin of Wakefield, named it sshole. It is tracked as CVE-2026-123158 and scored 8.1 (high) on CVSS 3.1. In plain terms: on some Linux systems, an attacker can log into … Read moresshole: the OpenSSH bug that lets a long password open an account with no password