[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6HEghAoLAPHUxg2s8BN8E9sbWdBdBrOHXmgnHgSZ_Oo":3},{"article":4,"iocs":41,"watch_terms":91,"solutions":92,"lesson":181},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"447b7900-6c68-4a00-b824-65918d9aa860","Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)","scans-for-sshole-vulnerability-cve-2026-123158-sun-nov-8th-4b7df5","Our honeypots use \"Cowrie\" to collect SSH data. With the emergence of the \"sshole\" vulnerability last week, we are now seeing an increase in attempts to exploit the vulnerability. Our data is a bit limited in this respect. Our honeypots collect only the first 255 characters of SSH passwords. Longer passwords are highly unusual and not used for the usual password brute-forcing we observe.","Honeypots using Cowrie are observing a rise in attempts to exploit the newly disclosed 'sshole' vulnerability (CVE-2026-123158). The data indicates an increase in long password entries, some of which appear to be buggy brute-force scripts that may have inadvertently executed commands, including malware downloads. The first actual exploit attempts were detected on November 5th.","Scans for the Sshole vulnerability (CVE-2026-123158) have increased.","https:\u002F\u002Fisc.sans.edu\u002Fdiary\u002Frss\u002F33498","https:\u002F\u002Fisc.sans.edu\u002Fdiaryimages\u002Fimages\u002Fimage2026110801.png","2026-11-08T15:44:33+00:00","2026-11-08T16:00:43.727084+00:00",8,[17,20],{"name":18,"type":19},"SSH","technology",{"name":21,"type":22},"Cowrie","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,46,50,54,57,59,61,63,65,67,69,71,73,75,77,79,81,83,85,87,89],{"type":43,"value":44,"context":45},"cve","CVE-2026-123158","Sshole vulnerability",{"type":47,"value":48,"context":49},"ip","156.238.252.37","IP address for malware download in buggy SSH password script",{"type":51,"value":52,"context":53},"url","http:\u002F\u002F156.238.252.37:8000\u002Fbot.x86_64","URL for malware download",{"type":47,"value":55,"context":56},"213.86.169.133","Source IP of scanner",{"type":47,"value":58,"context":56},"152.233.50.185",{"type":47,"value":60,"context":56},"92.255.57.7",{"type":47,"value":62,"context":56},"195.178.110.78",{"type":47,"value":64,"context":56},"109.94.173.13",{"type":47,"value":66,"context":56},"87.241.132.12",{"type":47,"value":68,"context":56},"52.119.124.122",{"type":47,"value":70,"context":56},"185.2.148.137",{"type":47,"value":72,"context":56},"220.77.237.35",{"type":47,"value":74,"context":56},"82.74.132.129",{"type":47,"value":76,"context":56},"220.70.219.98",{"type":47,"value":78,"context":56},"154.80.128.173",{"type":47,"value":80,"context":56},"121.190.39.238",{"type":47,"value":82,"context":56},"121.163.224.97",{"type":47,"value":84,"context":56},"58.151.184.226",{"type":47,"value":86,"context":56},"62.210.173.100",{"type":47,"value":88,"context":56},"183.99.38.238",{"type":47,"value":90,"context":56},"112.162.23.132",[21],{"controls":93,"vendors":180},[94,123,152],{"slug":95,"name":96,"problem":97,"products":98},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":124,"name":125,"problem":126,"products":127},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":40,"name":153,"problem":154,"products":155},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[156,164,172],{"vendor_slug":157,"vendor_name":158,"vendor_logo":159,"product_slug":160,"product_name":161,"url":162,"description":163},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":165,"vendor_name":166,"vendor_logo":167,"product_slug":168,"product_name":169,"url":170,"description":171},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":173,"vendor_name":174,"vendor_logo":175,"product_slug":176,"product_name":177,"url":178,"description":179},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",[],{"slug":182,"title":183,"body":184,"framework_refs":185,"framework_notes":193},"active-exploitation-of-sshole-vulnerability-highlights-rapid-weaponization-risk","Active Exploitation of 'Sshole' Vulnerability Highlights Rapid Weaponization Risk","The CVE-2026-123158 ('sshole') vulnerability began attracting active exploit attempts within days of public disclosure, as observed through honeypot data showing surges in long password entries and malware download attempts. This demonstrates how threat actors rapidly weaponize newly disclosed vulnerabilities, often before organizations have had time to patch. Some of the observed scripts appear to be buggy or automated brute-force tools that inadvertently executed commands, illustrating that even unsophisticated attackers can cause serious harm during the exploitation window. The incident underscores the critical importance of minimizing the time between vulnerability disclosure and remediation, particularly for internet-facing systems.",[186,187,188,189,190,191,192],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":194,"NIST SP 800-53 SI-2: Flaw Remediation":195,"CIS Control 17: Incident Response Management":196,"OWASP A06:2021 Vulnerable and Outdated Components":197,"CIS Control 7: Continuous Vulnerability Management":198,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":199,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":200},"NIS2 requires entities to implement vulnerability handling and patch management policies; the rapid exploitation window seen here demonstrates exactly why NIS2 mandates proactive and timely vulnerability management practices.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timescales — a formal flaw remediation process with tight SLAs would have driven faster patching of CVE-2026-123158.","The detection of active exploit attempts via honeypots required a swift incident response; a mature IR capability with pre-defined playbooks for newly disclosed CVEs would have accelerated containment and reduced malware download success rates.","The exploitation of a known, recently disclosed vulnerability in deployed software is a textbook A06 scenario, highlighting the need to track and promptly update vulnerable components in internet-facing systems.","Exploit attempts began within days of disclosure; a continuous vulnerability management program with rapid scanning and prioritized remediation would have identified and closed the exposure before attackers could capitalize on it.","This control mandates timely identification and remediation of technical vulnerabilities; had it been followed, the organization would have had a process to assess and patch the sshole vulnerability before active scanning began.","The attack vector involved long\u002Fmalformed password submissions; stronger authentication controls and input validation at the access layer could have mitigated or disrupted the brute-force and exploit attempts."]