⚡ Weekly Recap: SSHole Exploited, APT Root RCE, Robot Takeovers, 15K Hacked Sites, and More

Summary: Threat actors are attempting to exploit CVE-2026-123158 (CVSS 8.1), codenamed SSHole, an OpenSSH flaw that can enable sign-ins to accounts with no password set on Linux systems running OpenSSH on the musl C library with PAM disabled, including Alpine Linux's default server configuration. As of November 9, 2026, 20 exploitation attempts had been recorded from 13 unique IP addresses in Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland, and the U.S.
Bottom line: The flaw needs no clever trick to work - a blank password is enough - and 13 IP addresses across nine countries were already probing it within days of disclosure, so any Alpine host with passwordless accounts is a standing invitation.

Read the original at The Hacker News ↗