Attackers exploit OpenSSH SSHole auth bypass on musl Linux (CVE-2026-123158)
GreyNoise logged 16 successful chains from six IPs after the 10.6p2 fix; one install of TAC Agent never reached its C2.
Stories per day · 30 days
1 RSS
Relatedopenssh5alpine2authentication-bypass2musl2alpine-linux1apt1brute-force1cowrie1cwpdoor1exploitation1honeypot1ssh1supply-chain1tac-agent1zyxel1
3 stories, newest first · one card per story
Stories tagged #sshole
Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
Scans for SSHole vulnerability (CVE-2026-123158) increase in honeypots
Honeypots report increase in SSH attacks for sshole starting November 1, with first exploits on November 5.