---
title: Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug
description: CISA adds OpenSSH’s SSHole login bypass to its exploited-flaws list as attackers hunt root SSH keys and plant backdoors on Linux servers.
canonical_url: https://codekeeper.co/ticker/feds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug
---

[Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities) | [Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug

CISA adds OpenSSH’s SSHole login bypass to its exploited-flaws list as attackers hunt root SSH keys and plant backdoors on Linux servers.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Nov 10, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Hackers are already abusing SSHole, an OpenSSH login bypass on Linux tracked as CVE-2026-123158. On Monday, CISA put it on its list of flaws known to be exploited, along with bugs in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex. GreyNoise spotted its first SSHole attack on November 7. Across 18 attack chains, intruders hunted for password hashes and root SSH keys, then tried slipping their own keys into authorized_keys to keep access. One crew dropped TAC Agent, a Python remote-control tool. watchTowr links other activity to botnets and crypto miners. US federal agencies must patch by November 12. Source: [The Hacker News](https://thehackernews.com/2026/11/cisa-warns-of-active-exploitation-of.html)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ffeds-order-fast-fixes-as-hackers-abuse-opensshs-sshole-bug%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Jailbroken DeepSeek Agent Ran a Telecom Hack Mostly Unsupervised Nov 10, 2026](https://codekeeper.co/ticker/jailbroken-deepseek-agent-ran-a-telecom-hack-mostly-unsupervised)

[Vulnerabilities SonicWall Warns of Actively Exploited SSLVPN Flaw That Can Bypass MFA Nov 9, 2026](https://codekeeper.co/ticker/sonicwall-warns-of-actively-exploited-sslvpn-flaw-that-can-bypass-mfa)

[Vulnerabilities CISA Gives Agencies Three Days to Patch Exploited WordPress Flaw Nov 5, 2026](https://codekeeper.co/ticker/cisa-gives-agencies-three-days-to-patch-exploited-wordpress-flaw)

[Cyberattacks Bitter Spy Group Rewrites Malware in Rust for South Asia Attacks Nov 3, 2026](https://codekeeper.co/ticker/south-asian-cyber-espionage-group-bitter-targets-with-upgraded-malware)