[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f0OlmSxCYMgRZlcgwdyxR-fMYGUrkiV1ud2ppI2xiUwQ":3},{"article":4,"iocs":52,"watch_terms":64,"solutions":65,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":29,"category":30,"article_tags":34},"55970c3d-cd92-43d8-829a-67a5ea90cb4a","Hackers exploit SSHole OpenSSH flaw to breach Linux systems","hackers-exploit-sshole-openssh-flaw-to-breach-linux-systems-2d302e","Hackers are actively exploiting the \"SSHole\" vulnerability (CVE-2026-123158) in OpenSSH to execute commands, steal credentials, and establish persistent access. [...]","Hackers are actively exploiting the 'SSHole' vulnerability (CVE-2026-123158) in OpenSSH, allowing them to bypass authentication on certain musl-based Linux systems. The flaw, disclosed by Ozgun Kultekin, enables attackers to log into accounts with asterisked password hashes, potentially leading to root access. Exploitation attempts began shortly after a proof-of-concept became available, with threat actors observed stealing credentials, establishing persistence, and deploying malware like TAC Agent.","Hackers exploit SSHole flaw in OpenSSH to breach Linux systems, steal credentials, and gain persistent access.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-exploit-sshole-openssh-flaw-to-breach-linux-systems\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F09\u002Fopenssh.jpg","2026-11-09T16:04:57+00:00","2026-11-09T17:00:02.930507+00:00",9,[17,20,23,26],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":22},"musl","technology",{"name":24,"type":25},"unknown","threat_actor",{"name":27,"type":28},"SSHole exploitation","campaign","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":29,"icon":31,"name":32,"slug":33},null,"Vulnerabilities","vulnerabilities",[35,37,42,47],{"category":36},{"id":29,"icon":31,"name":32,"slug":33},{"category":38},{"id":39,"icon":31,"name":40,"slug":41},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":43},{"id":44,"icon":31,"name":45,"slug":46},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":48},{"id":49,"icon":31,"name":50,"slug":51},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[53,57,61],{"type":54,"value":55,"context":56},"cve","CVE-2026-123158","SSHole vulnerability in OpenSSH",{"type":58,"value":59,"context":60},"domain","tac.vpnla[.]org","Command and control (C2) server for TAC Agent",{"type":41,"value":62,"context":63},"TAC Agent","Python command-and-control agent deployed by attackers",[18],{"controls":66,"vendors":150},[67,96,121],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":97,"name":98,"problem":99,"products":100},"patch-management","Automated patch management","Known holes get closed in days, not months.",[101,108,113],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":97,"product_name":105,"url":106,"description":107},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":109,"product_name":110,"url":111,"description":112},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":122,"name":123,"problem":124,"products":125},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"sshole-openssh-flaw-exploited-shortly-after-poc-release","SSHole OpenSSH Flaw Exploited Shortly After PoC Release","The SSHole vulnerability (CVE-2026-123158) in OpenSSH allowed attackers to bypass authentication on musl-based Linux systems by exploiting how asterisked password hashes are handled, potentially granting root access without valid credentials. Exploitation began almost immediately after a proof-of-concept was published, underscoring the dangerously short window organizations have between disclosure and active attack. Threat actors leveraged the flaw to steal credentials, establish persistent footholds, and deploy malware such as TAC Agent. This incident illustrates a recurring pattern: widely deployed open-source infrastructure components become high-value targets, and organizations that lack rapid patch deployment processes will consistently fall behind attackers who weaponize public exploits within hours.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":170,"MITRE ATT&CK T1566: Phishing":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices — both of which were critical failure points in this rapid post-PoC exploitation scenario.","While the initial vector here is vulnerability exploitation rather than phishing, ATT&CK's broader adversary lifecycle (credential theft, persistence via TAC Agent) maps directly to techniques T1078 (Valid Accounts) and T1543 (Create or Modify System Process), highlighting the need for detection controls across the full kill chain.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes — a process that, if enforced, would have closed the SSHole window before active exploitation.","OpenSSH is a foundational open-source component; A06 directly addresses the risk of running known-vulnerable versions of such components in production environments.","Regular authenticated scanning would have identified unpatched OpenSSH instances on musl-based systems before attackers exploited the publicly available PoC.","A.8.8 mandates timely identification and remediation of technical vulnerabilities, which would have driven an emergency patch cycle the moment CVE-2026-123158 was disclosed.","The vulnerability allowed authentication bypass; enforcing certificate-based or MFA-protected SSH access, as called for by PR.AA, would have mitigated the impact even on unpatched systems."]