Scanners exploit new SSH 'Sshole' flaw
Honeypots show rapidly rising scanning and live exploit attempts against the newly disclosed 'Sshole' SSH vulnerability (CVE-2026-123158).
Sourceisc.sans.edu — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-123158 as exploited in the wild.
SANS ISC reports a surge in SSH login attempts using abnormally long passwords, tied to the newly disclosed 'Sshole' vulnerability (CVE-2026-123158). Using Cowrie honeypot data, researchers observed a sharp increase in long-password attempts beginning November 1st, peaking at 713 events on November 6th, with the first confirmed exploit attempt (using an all-'A' password) appearing on November 5th. The vulnerability appears related to SSH authentication handling of oversized password inputs, though full technical details are limited by the honeypot's 255-character capture limit.
Separately, the honeypot also captured unrelated 'buggy' brute-force scripts that mistakenly submit post-login shell commands as passwords — in one case a command string that downloads and chmods a binary (bot.x86_64) from an external host, suggesting some brute-forcers are retrieving bot malware payloads when their injection succeeds. The report lists numerous source IPs conducting the Sshole-related scanning, predominantly from hosting/VPS providers and a cluster of Korea Telecom (KIXS-AS-KR) addresses, indicating widespread internet-wide probing rather than a single coordinated campaign.
Defenders running internet-facing SSH services should monitor for authentication attempts with unusually long passwords, patch or mitigate per vendor guidance for CVE-2026-123158 once available, and treat the listed scanning IPs and payload-hosting IP as indicators of active probing or exploitation attempts.
Mentioned in this report
Detection guidance
Linux Shell Command Downloading and Making a Binary Executable
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a single shell command line that fetches a file with wget, curl or tftp and also runs chmod. This is the typical bot-payload staging one-liner that SSH brute-forcers run after a successful login. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Shell Command Downloading and Making a Binary Executable
description: Detects a shell invocation whose command line combines a download utility
(wget, curl, tftp) with chmod, the typical bot payload staging one-liner run by
SSH brute-forcers after a successful login. Generalises on the download-plus-chmod
pattern, not on a specific host or filename.
status: experimental
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: linux
detection:
selection_shell:
Image|endswith:
- /sh
- /bash
- /dash
selection_download:
CommandLine|contains:
- 'wget '
- 'curl '
- 'tftp '
selection_chmod:
CommandLine|contains: 'chmod '
condition: selection_shell and selection_download and selection_chmod
falsepositives:
- Installer or bootstrap scripts that download a binary and chmod it, run via sh -c
by configuration management
- Administrators manually installing tools from a vendor URL
level: medium
id: 5a6f62f7-be88-55e7-9f1b-1f44e3bf010f
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33498
Download Utility Launched Directly From an SSH Session Command
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects sshd directly spawning wget, curl or tftp, or a shell with a download command, as seen when brute-forced SSH access is used to pull malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Download Utility Launched Directly From an SSH Session Command
description: Detects sshd spawning a download utility directly, or a shell whose command
line invokes one, which is consistent with a remote command executed over SSH after
a successful brute-force login to fetch a bot payload.
status: experimental
tags:
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: linux
detection:
selection_direct:
ParentImage|endswith: /sshd
Image|endswith:
- /wget
- /curl
- /tftp
selection_shell:
ParentImage|endswith: /sshd
Image|endswith:
- /sh
- /bash
- /dash
CommandLine|contains:
- 'wget '
- 'curl '
- 'tftp '
condition: 1 of selection_*
falsepositives:
- Administrators or automation (Ansible, CI jobs) running curl or wget remotely over
SSH
- Remote monitoring scripts that fetch health-check URLs via SSH exec
level: medium
id: 8b297559-26dc-53da-aa51-be02f83df57a
author: Vorant
references:
- https://isc.sans.edu/diary/rss/33498
2 more detections for this report are in the app — indicator rules, each with Sigma, Splunk SPL, and Elastic, some with Suricata as well. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://isc.sans.edu/diary/rss/33498
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs