Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

The SSHole vulnerability in OpenSSH allowed unauthenticated attackers to gain full root access by exploiting a flaw in how the service handles oversized passwords on passwordless accounts — a severe misconfiguration compounded by an unpatched system. Threat actors began exploitation within just nine hours of the CVE being published, underscoring how rapidly adversaries operationalize newly disclosed vulnerabilities. This incident highlights the critical need for near-real-time vulnerability response programs, particularly for internet-facing services like SSH. Allowing passwordless accounts on publicly accessible SSH services also represents a dangerous access control gap that dramatically lowers the bar for exploitation. Organizations that lack automated patching pipelines or asset visibility are especially exposed when high-severity flaws like this emerge.