Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot
Summary: Previdian observed the first exploitation attempt against the OpenSSH flaw CVE-2026-123158 (CVSS 8.1, codenamed SSHole) less than nine hours after the CVE was published, and confirmed successful root access on a honeypot running Alpine Linux and OpenSSH. The bug, found by researcher Ozgun Kultekin and fixed in OpenSSH 10.6p2, lets an unauthenticated attacker log in to accounts whose password field holds an asterisk by supplying an oversized password of 257 to 1,024 bytes, and by November 8, 2026, attempts had risen to 20 from 13 unique IP addresses across nine countries.
What you should know: Root on a honeypot within nine hours of disclosure means the window between patch release and active exploitation is now measured in hours, and the affected configuration is Alpine Linux's default OpenSSH server setup, not an exotic edge case. Alpine's guidance is blunt: if you cannot rule out a login, treat the machine as compromised.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-6210CVE-2026-123158
- Related
- CISA Adds Four Known Exploited Vulnerabilities to Catalog Cyber Risks · Nov 09, 2026CVE-2026-123158: OpenBSD OpenSSH Unexpected Status Code or Return Value Vulnerability Known Exploited Vulnerabilities · Nov 09, 2026