The November 9 addition follows successful attacks on certain Linux configurations. OpenSSH has released a fix, and affected administrators can disable password authentication if they cannot update immediately.
CISA added the OpenSSH vulnerability CVE-2026-123158, known as SSHole, to its Known Exploited Vulnerabilities catalog on 9 November 2026, citing evidence of active exploitation. The flaw lets attackers bypass password checks on certain Linux systems, making affected remote-login services a priority for repair.
Security researcher Ozgun Kultekin disclosed SSHole the previous week. OpenSSH maintainers released a fix in version 10.6p2 on 5 November; public exploit code appeared roughly 4 hours later, BleepingComputer said.
The flaw requires OpenSSH to run with musl, a software code library, without PAM, a framework that handles authentication and account-access checks. Affected configurations include some Alpine Linux systems used in cloud and virtual environments.
Ars Technica said the configuration also needs at least 1 account with a password hash—a stored representation of a password—created using SHA256 or SHA512. The account targeted for the bypass has an asterisk in its stored password field, normally used to prevent password logins.
An oversized password makes musl’s password-hashing function return an asterisk as an error. OpenSSH mistakenly accepts that error value as a match for the account’s stored value. Kultekin said accounts with valid password hashes are unaffected; a compromised account can give an attacker root access—full administrative control—if it has passwordless administrative privileges.
Red Hat says its products are unaffected because its OpenSSH builds use the GNU C Library, or glibc, and PAM by default.
GreyNoise recorded 16 successful exploitation chains from 6 source IP addresses on monitored networks. Its Southeast Asian honeypots—systems used to observe attacks—were among those targeted. These observations are not a count of confirmed outside victims, and GreyNoise said they were not representative of broader SSHole activity. Separately, GreyNoise recorded 27.5 million port-22 scans and 20.1 million attempted SSH sessions, but these were not confirmed SSHole attacks.
Previdian also detected successful exploitation. Its figures of 20 attempts from 13 attacker IP addresses geolocated to 9 countries describe attempts and their apparent origins, not victims. watchTowr said on 6 November that it had observed exploitation associated with botnets, or networks of compromised devices, and cryptocurrency activity.
GreyNoise calls the group attacking its Southeast Asian honeypots GT10. Access to a GT10 server revealed potential other victims, the company said, without confirming those additional compromises.
In the observed attacks, intruders examined systems and containers, queried cloud services for information about the machines, and tried to read password hashes and root SSH keys. They also tried to alter authorized_keys files, which control key-based login access, to retain entry.
GreyNoise observed 1 attacker gain root privileges and install TAC Agent, a Python implant that accepts commands from an attacker’s server. That installation could not reach its command server and received no task. The implant supports commands, reconnaissance, file transfers and self-updating, but has no built-in way to survive a restart; attackers tried to arrange that through a startup service.
GreyNoise found Chinese-language comments, logs and errors in the implant, describing them as clues to combine with other evidence about attacker origin. Ars Technica said the backdoor appeared to have been generated using superintelligence (SI); BleepingComputer described a tool-check behavior as suggesting possible automated operation. Attacker nationality and SI involvement remain unconfirmed.
CISA added these companion vulnerabilities on the same evidence-of-exploitation basis, without giving victim counts.
| Software | Vulnerability | Flaw type |
|---|---|---|
| GPUStack | CVE-2026-102895 | Improper authentication |
| SignalWire FreeSwitch | CVE-2026-116779 | Code injection |
| IBM Aspera Faspex | CVE-2026-123218 | Incorrect authorization |
BleepingComputer recommends promptly updating OpenSSH or disabling SSH password authentication on affected systems if an update cannot be applied immediately. Administrators should check for unexpected successful password logins to accounts marked with an asterisk in /etc/shadow, unauthorized SSH keys, and TAC Agent files or startup services.
CISA says Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of catalog-listed flaws on publicly exposed systems where exploitation grants total control. The directive also establishes expectations for checking whether attackers compromised a system before it was patched.
That requirement applies only to those federal agencies. CISA encourages other organizations to prioritize catalog-listed vulnerabilities through risk-based remediation.
The Starbase City Commission will consider a property tax abatement and a related economic development agreement on 9 December 2026. The estimate covers the project’s initial phases.
2 min
The first academy and a developer center are planned for Istanbul in 2027, followed by a manufacturing academy in Ankara in 2028.
2 min
Anthropic says reads of stored material cost $0.10 per million tokens, down from $0.20, while input and output rates stay at $2 and $10 per million tokens.
2 min
