[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fj4D3ETVP2vLOSyeNYU4orJSitOYHBQVni2prIJwM40o":3},{"article":4,"iocs":51,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"e8d60b4b-a173-4ba5-8a2a-fab638621821","OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)","openssh-flaw-exploited-in-the-wild-just-hours-after-disclosure-cve-2026-123158-39e696","An OpenSSH flaw that lets remote attackers log into passwordless accounts on Alpine Linux and other musl-based systems is being exploited, threat intelligence firm Previdian has warned. The flaw (CVE-2026-123158), nicknamed sshole by Wakefield researcher Özgün Kültekin, was fixed in OpenSSH 10.6p2 on November 5. “An attacker who can reach your SSH port can log in without knowing any password. It takes one connection, works every time, and needs no retries,” the Alpine Linux team … More → The post OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) appeared first on Help Net Security.","A critical vulnerability in OpenSSH, nicknamed 'sshole', is being actively exploited in the wild. The flaw allows remote attackers to log into passwordless accounts on musl-based systems like Alpine Linux by sending an oversized password. The vulnerability was fixed in OpenSSH 10.6p2 on November 5, but exploitation was observed less than nine hours after its CVE publication.","OpenSSH flaw (CVE-2026-123158) exploited in the wild hours after disclosure.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F06\u002Fopenssh-sshole-cve-2026-123158-exploitation\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F07\u002F06145725\u002Fopenssh-1500.webp","2026-11-06T12:49:41+00:00","2026-11-06T13:00:22.609945+00:00",9,[17,20,22,25],{"name":18,"type":19},"OpenSSH","product",{"name":21,"type":19},"Alpine Linux",{"name":23,"type":24},"Previdian","vendor",{"name":26,"type":27},"musl","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-123158","OpenSSH vulnerability nicknamed sshole",{"type":57,"value":58,"context":59},"ip","89.116.89.18","Observed IP address used in exploitation attempts",[23,18,21],{"controls":62,"vendors":149},[63,92,121],{"slug":64,"name":65,"problem":66,"products":67},"patch-management","Automated patch management","Known holes get closed in days, not months.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":93,"name":94,"problem":95,"products":96},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[97,105,113],{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"slug":50,"name":122,"problem":123,"products":124},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"cve-2026-123158-critical-openssh-sshole-flaw-exploited-within-hours-of-disclosure","CVE-2026-123158: Critical OpenSSH 'sshole' Flaw Exploited Within Hours of Disclosure","A critical OpenSSH vulnerability dubbed 'sshole' was actively exploited in the wild less than nine hours after its CVE was published, demonstrating how rapidly threat actors operationalize newly disclosed flaws. The flaw allows unauthenticated remote attackers to log into passwordless accounts on musl-based systems such as Alpine Linux simply by sending an oversized password, representing a severe authentication bypass. Although a patch was available in OpenSSH 10.6p2 from November 5th, the gap between patch availability and widespread deployment left countless systems exposed. This incident underscores why emergency patching procedures and rapid vulnerability response capabilities are no longer optional for organizations running internet-facing SSH services.",[155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":163,"PCI DSS Requirement 6":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":169},"NIS2 mandates that essential and important entities implement incident handling and vulnerability management practices; the speed of exploitation highlights the need for the rapid response procedures NIS2 requires.","PCI DSS Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through timely patching, which would have required upgrading OpenSSH well within the exploitation window observed here.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes; a compliant process would have mandated rapid deployment of the OpenSSH 10.6p2 patch before exploitation occurred.","Running an unpatched version of OpenSSH on internet-facing systems is a textbook A06 failure; organisations tracking component versions and applying patches promptly would not have been exposed.","A structured continuous vulnerability management programme would have flagged the OpenSSH flaw immediately upon CVE publication and triggered an emergency patching workflow, closing the window of exploitation within hours.","This control explicitly requires timely identification and remediation of technical vulnerabilities, including tracking patch availability and acting on it promptly — directly addressing the patch lag exploited in this incident.","The vulnerability was exploited to bypass authentication on passwordless accounts; enforcing strong authentication policies and prohibiting passwordless SSH access would have mitigated the impact even on unpatched systems."]