[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faCFO0mWWdvPY0Yvt1zG0G-WGEn_O9yQN92xGHQG3YaQ":3},{"article":4,"iocs":51,"watch_terms":63,"solutions":64,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"cc4f2d57-cb29-4e51-935f-4d69b1ee9182","Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot","hackers-target-openssh-sshole-flaw-within-hours-of-disclosure-gain-root-on-honey-12404f","Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian. The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,","A critical vulnerability in OpenSSH, dubbed SSHole (CVE-2026-123158), is being actively exploited by threat actors. The flaw allows unauthenticated attackers to gain root access on vulnerable Linux systems by sending oversized passwords to accounts configured without passwords. Exploitation attempts were observed within nine hours of the CVE's publication, with successful root access confirmed on a honeypot.","Hackers exploit OpenSSH SSHole flaw within hours of disclosure, gaining root access on a honeypot.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fhackers-exploited-openssh-sshole-flaw.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjHbl1TAGj_ZHZDF3oQ8AfebRDiovg_d8Wk4huY5VJkSa0csE45G7k5jwdG1De-W-7l2RjnyH_ZvT3vcioykVeOooifwvViM8RiuTu0gSt2t-XgOefyYKyM5_zbsI5WFNubkIT0hOUr4inPIQMvXs6GDTLa6j7XWL3etRJYvOcDLJxa3IDXv-KtuCma5JsG\u002Fs1600\u002Fssh.jpg","2026-11-06T15:21:49+00:00","2026-11-06T17:00:25.207714+00:00",9,[17,20,23,25,27,30],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":22},"musl C library","technology",{"name":24,"type":22},"Pluggable Authentication Modules",{"name":26,"type":19},"Alpine Linux",{"name":28,"type":29},"Previdian","vendor",{"name":31,"type":32},"hackers","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,41,46],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,59],{"type":53,"value":54,"context":55},"cve","CVE-2026-123158","OpenSSH SSHole vulnerability",{"type":53,"value":57,"context":58},"CVE-2016-6210","Related username enumeration vulnerability",{"type":60,"value":61,"context":62},"ip","89.116.89.18","IP address observed in exploitation attempts from Japan",[28,18,26],{"controls":65,"vendors":147},[66,95,121],{"slug":67,"name":68,"problem":69,"products":70},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,105,113],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":101,"product_name":102,"url":103,"description":104},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":122,"name":123,"problem":124,"products":125},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":143,"product_name":144,"url":145,"description":146},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"cve-2026-123158-sshole-root-access-exploited-within-hours-of-disclosure","CVE-2026-123158 (SSHole): Root Access Exploited Within Hours of Disclosure","The SSHole vulnerability in OpenSSH allowed unauthenticated attackers to gain full root access by exploiting a flaw in how the service handles oversized passwords on passwordless accounts — a severe misconfiguration compounded by an unpatched system. Threat actors began exploitation within just nine hours of the CVE being published, underscoring how rapidly adversaries operationalize newly disclosed vulnerabilities. This incident highlights the critical need for near-real-time vulnerability response programs, particularly for internet-facing services like SSH. Allowing passwordless accounts on publicly accessible SSH services also represents a dangerous access control gap that dramatically lowers the bar for exploitation. Organizations that lack automated patching pipelines or asset visibility are especially exposed when high-severity flaws like this emerge.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":161,"NIST SP 800-53 SI-2: Flaw Remediation":162,"CIS Control 17: Incident Response Management":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 mandates incident handling and vulnerability disclosure response procedures, which would require operators of essential services to act immediately upon publication of a critical CVE like SSHole.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined timeline — a process that would have prioritized rapid patching of this critical OpenSSH vulnerability.","A mature incident response capability — including playbooks for rapid exploitation of newly disclosed CVEs — would have enabled faster detection, containment, and recovery when honeypot compromise was confirmed.","Running an unpatched version of OpenSSH on an internet-facing system is a textbook instance of the vulnerable and outdated components risk, which OWASP identifies as a top web and infrastructure threat.","A structured vulnerability management program with defined patching SLAs would have ensured SSHole was remediated before attackers could exploit it within the nine-hour window.","This control requires timely identification and remediation of technical vulnerabilities, directly addressing the failure to patch OpenSSH before active exploitation began.","The existence of passwordless accounts exposed to SSH represents a fundamental authentication control failure that this framework item specifically requires organizations to prevent."]