---
title: Tip: treat Alpine/musl OpenSSH as under active scan — patch to 10.6p2, restart sshd, or turn password auth off now | ctxsec
url: https://ctxsec.com/items/tip-patch-alpine-sshole-now-exploited
description: "SSHole is no longer a theoretical one-shot bypass. watchTowr is already seeing botnet and miner traffic. Any internet-facing Alpine sshd that still accepts passwords and has a '*' account is a free login."
status: "official guidance (Alpine Nov 5) + confirmed exploitation signal (watchTowr Intel Nov 6)"
published: 2026-11-06
---

> SSHole is no longer a theoretical one-shot bypass. watchTowr is already seeing botnet and miner traffic. Any internet-facing Alpine sshd that still accepts passwords and has a '*' account is a free login.

[← Tips & Guides](/tips) · [markdown](/items/tip-patch-alpine-sshole-now-exploited.md)

official guidance (Alpine Nov 5) + confirmed exploitation signal (watchTowr Intel Nov 6)

2026-11-06

### Tip: treat Alpine/musl OpenSSH as under active scan — patch to 10.6p2, restart sshd, or turn password auth off now

- Upgrade `openssh` / `openssh-server` and **restart sshd** immediately. Confirm the running binary matches the package.
- If you cannot patch yet: set `PasswordAuthentication no`, restart sshd, and keep key-only (or a jump host) in front.
- Inventory: password auth on? any account with `*` in shadow (root since Alpine ~3.16, key-only users, tiny-cloud `alpine`, musl-nscd directory users)? any local $5$/$6$ hash? All three means exposed.
- Watch auth logs for single successful logins with absurdly long passwords and for mass probes of Alpine banners.

Sources: [Alpine Linux advisory](https://alpinelinux.org/posts/2026-11-05-openssh-password-authentication-bypass/) · [watchTowr exploitation note](https://x.com/watchtowrcyber/status/2118636513739317525)