OpenSSH flaw allows passwordless logins on musl systems

OpenSSH is in the spotlight after a recently disclosed flaw allowing sign‑ins to accounts with no password when PAM is disabled on musl‑based systems.

The vulnerability, tracked as CVE-2026-123158 and nicknamed SSHole, is being actively probed by threat actors, with 20 exploitation attempts recorded from 13 unique IP addresses across Denmark, Iran, Japan, the Netherlands, Norway, Singapore, Sweden, Switzerland and the United States as of 9 November 2026, according to The Hacker News’ weekly recap reported by Ravie Lakshmanan.

The piece notes that vulnerable configurations include Alpine Linux’s default OpenSSH setup, underscoring the risk posed when passwordless sign‑ins are possible and monitored activity remains limited.

The roundup also highlights several other notable developments. Debian and Ubuntu users face an APT vulnerability, CVE-2026-109518 (CVSS 7.7), enabling code execution as root under HTTP sources with retry settings when a man‑in‑the‑middle position is possible between host and mirror, per an Amazon security advisory cited by The Hacker News.

Additional items include a trojanised CWP Web Server delivering a backdoor (CWPdoor) via a remote cwpsrv replacement, identified by XLab; a cPGuard update‑channel hijack delivering a backdoor, reported by OPSSHIELD; and other disclosures such as Plex2Shell exploitation affecting Plex Media Server on QNAP NAS, and a CPython zero‑day related to AI hosting platforms, among numerous other entries attributed to various researchers, vendors and outlets within the recap published on 9 November 2026.