[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:sshole-cve-2026-123158-openssh-authentication-bypass-hits":3},{"post":4,"author":19,"controls":26,"vendors":27,"more":28},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":12,"reading_minutes":18},"sshole-cve-2026-123158-openssh-authentication-bypass-hits","rapid-alert","SSHole (CVE-2026-123158): OpenSSH authentication bypass hits Alpine and musl systems, exploited within hours","An OpenSSH flaw lets attackers log into passwordless accounts on Alpine Linux and other musl-based systems using an oversized password. One connection, no retries. Patched in 10.6p2 on 5 Nov, exploited in the wild within nine hours. What to do tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsshole-cve-2026-123158-openssh-authentication-bypass-hits-0144dfdb-cover.png","OpenSSH 10.6p2 rapid alert: Your container built on Alpine? One SSH connection and root is theirs.","Marcus Lenngren","2026-11-06T13:21:25.555+00:00","![OpenSSH 10.6p2 rapid alert: Your container built on Alpine? One SSH connection and root is theirs.](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fsshole-cve-2026-123158-openssh-authentication-bypass-hits-0144dfdb-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nOpenSSH shipped an emergency fix on 5 November for an authentication bypass nicknamed SSHole, tracked as CVE-2026-123158 (CVSS 8.1). On musl-based Linux systems, such as Alpine, with PAM disabled and password login on, an attacker can log into an account that has no password by sending a password between 257 and 1,024 characters.\n\nThe root cause goes back to 2016. To close a username enumeration flaw (CVE-2016-6210), sshd was changed to hash a password even when an account has no usable hash, borrowing another account's salt. Since 2012, musl's crypt() rejects SHA-256 and SHA-512 passwords longer than 256 bytes and returns \"*\" on failure. Accounts configured for key-only or no login carry \"*\" in \u002Fetc\u002Fshadow. The \"*\" error value matches the stored \"*\", and sshd lets the attacker in.\n\nThe flaw does not bypass passwords on accounts that have a real hash. OpenSSH developer Damien Miller says the bug is not in sshd itself but can be triggered through it. The 10.6p2 release blocks the path.\n\n## Timeline\n\n- 4 Nov: OpenSSH is told about the flaw.\n- 5 Nov: OpenSSH 10.6p2 ships; Alpine pushes patched packages for every branch from 3.16 to edge.\n- 5 Nov: Proof-of-concept exploits appear on GitHub (unverified, may contain malware).\n- Less than 9 hours after CVE publication: Previdian's sensors see the first attempt.\n- 6 Nov: Previdian confirms successful root access on an Alpine honeypot. Eight attempts seen so far, all from a single Japan-based address, 89.116.89[.]18, running id, uname and hostname.\n\nCISA has not yet added it to KEV. Previdian has added it to its own known-exploited list.\n\n## Am I affected?\n\nYou are at risk if all of these hold:\n\n- OpenSSH runs on a musl-based system: Alpine, OpenWrt, Buildroot, Yocto, or many Docker images.\n- PAM is disabled (the default for Alpine's openssh-server package, or openssh-server-pam with UsePAM no).\n- SSH password authentication is enabled (the OpenSSH default).\n- At least one account has \"*\" in its password field (root since about Alpine 3.16, key-only users made with adduser and no password, the default alpine user in cloud images, or musl-nscd directory users).\n- At least one other local account has a $5$ or $6$ password hash.\n\nAlpine's official AWS and Azure tiny-cloud images (3.18.11 through 3.24.3) ship a default alpine account with \"*\" and passwordless doas, so a login there is effectively root.\n\nNot affected: glibc systems (Debian, Ubuntu, Fedora), PAM-enabled setups (UsePAM yes), Dropbear, OpenBSD, and containers that do not run sshd.\n\n## What to do now\n\n1. Update OpenSSH. On Alpine: apk upgrade openssh. Fixed releases include 3.21.10, 3.22.8, 3.23.8 and 3.24.4. A lower version number may still be patched.\n2. Restart sshd. Updating alone leaves the old daemon running and still vulnerable. Keep an existing session open while you do this.\n3. If you cannot patch yet, set PasswordAuthentication no in sshd_config, confirm key-based access works, and restart sshd.\n4. Block or watch the known source IP 89.116.89[.]18.\n\n## How to hunt\n\nLook for password logins to accounts that should not accept one:\n\n- `grep \"Accepted password\" \u002Fvar\u002Flog\u002Fmessages`\n- If the alpine, root or a key-only user appears, check the shadow field: `grep '^alpine:' \u002Fetc\u002Fshadow`. A \"*\" there plus a successful password login is a strong sign of exploitation.\n- Review doas use, recently created users and authorized_keys files.\n\nIf you cannot rule out a login, treat the machine as compromised.\n\n## What does not help\n\n- Running apk upgrade without restarting sshd. The running daemon keeps accepting connections.\n- Relying on PermitRootLogin to protect you. The larger risk is indirect root through accounts like the default alpine user with passwordless doas.\n- Downloading the GitHub PoCs. Previdian warns they are unverified and may contain malware.\n\n## Sources\n\n- [OpenSSH Rushes Patches for ‘SSHole’ Authentication Bypass](https:\u002F\u002Fwww.securityweek.com\u002Fopenssh-rushes-patches-for-sshole-authentication-bypass\u002F), SecurityWeek, 6 Nov\n- [OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158)](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F06\u002Fopenssh-sshole-cve-2026-123158-exploitation\u002F), Help Net Security, 6 Nov\n- [OpenSSH Flaw Could Let Attackers Bypass Password Authentication on Alpine Linux Servers](https:\u002F\u002Fcybersecuritynews.com\u002Fopenssh-flaw-bypass-password-authentication\u002F), Cyber Security News, 5 Nov\n- [OpenSSH flaw lets attackers log into password-disabled Linux accounts](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fopenssh-flaw-lets-attackers-log-into-password-disabled-linux-accounts\u002F), BleepingComputer, 5 Nov\n- [OpenSSH Issues Emergency Fix for Flaw Letting Long Passwords Bypass SSH Auth on Alpine Linux](https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fopenssh-issues-emergency-fix-for-flaw.html), The Hacker News, 5 Nov\n",null,[],true,false,3,{"name":11,"slug":20,"same_as":21,"job_title":22,"photo_url":23,"short_bio":24,"linkedin_url":25},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[29,36,43],{"slug":30,"kind":6,"title":31,"excerpt":32,"cover_image_url":33,"cover_image_alt":34,"author_name":11,"published_at":35,"reading_minutes":18},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":37,"kind":6,"title":38,"excerpt":39,"cover_image_url":40,"cover_image_alt":41,"author_name":11,"published_at":42,"reading_minutes":18},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":44,"kind":6,"title":45,"excerpt":46,"cover_image_url":47,"cover_image_alt":48,"author_name":11,"published_at":49,"reading_minutes":18},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]