France's national cybersecurity agency has issued an urgent alert about a flaw in OpenSSH, the software that handles remote logins on most Linux servers, that lets an attacker get past the password check on certain systems. The OpenSSH project published the fix in release 10.6p2 on 5 November 2026, and CERT-FR, part of ANSSI in France, describes the bug as trivial to exploit when the right conditions are met.
CERT-FR issues alerts, rather than routine advisories, when it judges a threat needs immediate attention, and it is asking administrators to check now whether their systems are in a vulnerable configuration.
Only some Linux builds are exposed
The bug does not affect every OpenSSH server. According to CERT-FR, a system is vulnerable when three things line up: it runs Linux, it uses the musl C standard library (the lightweight alternative to glibc found in minimal distributions such as Alpine Linux and in many container images), and OpenSSH was compiled without PAM support or runs with PAM turned off. PAM is the pluggable authentication layer most Linux distributions use to check passwords.
On such a system, CERT-FR says, an attacker can connect by supplying two passwords, the second of which is longer than 256 characters and shorter than 1,024. The alert does not list a CVE identifier, and OpenSSH's release notes carry the technical detail.
Check accounts that should never log in
The researcher who found the flaw, who published the finding under the name sshhole, recommends a specific check: look at every system account whose password field in /etc/shadow is a single asterisk, meaning password login is disabled, and confirm that none of them shows a successful password login in the logs. CERT-FR reproduces the suggested command, which lists those accounts and searches /var/log/messages for "Accepted password for" entries against each one. Any hit for an account that is not supposed to accept passwords deserves a full investigation.
SSH servers that accept passwords are already a favourite target, as a self-spreading cryptominer that hijacks weakly secured Linux SSH servers showed, so exposed hosts in this configuration should be checked first.
Upgrade to OpenSSH 10.6p2, or turn off passwords
The fix is OpenSSH 10.6p2, and every version before it is listed as affected. Most administrators will get it through their distribution's package updates, so confirm the update has landed on musl-based hosts and container images, not only on the main server fleet. Where patching is not yet possible, CERT-FR advises disabling password authentication, and if that cannot be done either, disabling the SSH service.
Key-based logins are the stronger default regardless. When a password check can be talked out of its job, the simplest defence is to stop asking for passwords at all.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.