[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBuquCP3A4pOyn018UXfyBICnPZmgT67WgETazsE62hM":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"a30874d1-2179-41a2-a107-85e17b1b963d","Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH","hackers-exploiting-sshole-authentication-bypass-in-openssh-52cb49","The initial exploitation attempts are attributed to botnets and crypto miners, but other threat actors are expected to follow suit. The post Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSH appeared first on SecurityWeek.","A critical authentication bypass vulnerability, dubbed SSHole (CVE-2026-123158), in OpenSSH is being actively exploited by threat actors. The flaw allows attackers to bypass authentication for certain accounts, including root, on Linux distributions using musl libc with PAM disabled, such as Alpine. Exploitation attempts have been observed by botnets and crypto miners, with broader threat actor adoption anticipated.","Hackers exploit SSHole auth bypass in OpenSSH, affecting Alpine and other Linux distros.","https:\u002F\u002Fwww.securityweek.com\u002Fhackers-exploiting-sshole-authentication-bypass-in-openssh\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FSSH.webp","2026-11-09T12:13:32+00:00","2026-11-09T13:00:14.229141+00:00",9,[17,20,23,25],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":22},"PAM","technology",{"name":24,"type":22},"musl libc",{"name":26,"type":19},"Alpine","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,35,40,45],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-123158","SSHole authentication bypass vulnerability in OpenSSH",[18,26],{"controls":57,"vendors":144},[58,87,115],{"slug":59,"name":60,"problem":61,"products":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":88,"name":89,"problem":90,"products":91},"patch-management","Automated patch management","Known holes get closed in days, not months.",[92,99,107],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":88,"product_name":96,"url":97,"description":98},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":116,"name":117,"problem":118,"products":119},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"sshole-authentication-bypass-highlights-urgent-openssh-patching-needs","SSHole Authentication Bypass Highlights Urgent OpenSSH Patching Needs","The SSHole vulnerability (CVE-2026-123158) exposes a critical flaw in OpenSSH that allows threat actors to completely bypass authentication, including for root accounts, on systems running musl libc with PAM disabled — a common configuration in lightweight Linux distributions like Alpine. Active exploitation by botnets and crypto miners confirms that attackers are rapidly weaponizing this flaw, meaning unpatched systems face immediate, real-world risk. This incident underscores how specific configuration choices (PAM disabled, musl libc) can silently elevate the impact of a vulnerability beyond what standard risk assessments anticipate. Organizations that lack timely patch cycles or accurate software inventories are most exposed, as they may not even know which systems are affected. The speed of botnet adoption demands emergency-level response, not routine patching cadences.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":158,"PCI DSS Requirement 6":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 mandates incident handling and vulnerability management practices for essential entities; active exploitation of SSHole by botnets triggers obligations to detect, respond to, and remediate this vulnerability promptly.","Requirement 6 mandates that organizations develop and maintain secure systems by protecting them from known vulnerabilities, directly applying to the need to patch OpenSSH against this authentication bypass on in-scope systems.","SI-2 requires organizations to identify, report, and correct information system flaws; a formal flaw remediation process with defined timelines would have mandated rapid patching of this critical authentication bypass.","Running unpatched versions of OpenSSH on musl libc systems directly matches this risk category, emphasizing the need to track component versions and act immediately when known vulnerabilities are published.","Routine vulnerability scanning would have identified CVE-2026-123158 on affected OpenSSH instances and triggered a time-bound patching response before botnet actors could exploit it at scale.","This control requires timely identification and remediation of technical vulnerabilities; applying it would have ensured SSHole was assessed for organizational impact and patched within an acceptable risk window.","The vulnerability directly bypasses authentication controls; this framework function requires organizations to ensure authentication mechanisms are robust and continuously verified, which would have flagged PAM-disabled configurations as a risk."]