OpenSSH Releases 10.6p2 to Patch SSHole Authentication Bypass as Exploits Emerge
Cybersecurity and privacy
The OpenSSH team issued an emergency 10.6p2 update to fix SSHole (CVE-2026-123158), an authentication bypass vulnerability exploitable via oversized passwords. Security firm Previdian detected attacks on honeypots within 9 hours of disclosure, where attackers gained root access to run reconnaissance. As of November 10, 22 attempts across 10 countries were tracked.
On November 5, the OpenSSH development team released an emergency update, version 10.6p2, to patch SSHole (CVE-2026-123158), an authentication bypass flaw triggered via oversized passwords. Cybersecurity firm Previdian revealed that active exploitation was first detected within 9 hours of the advisory in a honeypot running Alpine Linux and OpenSSH. The attacker bypassed authentication, obtained root privileges, and ran non-interactive reconnaissance commands including id, uname, and hostname. According to Previdian's tracking, 22 exploitation attempts originating from 14 IP addresses across 10 countries—including Switzerland, Denmark, Spain, Iran, Japan, the Netherlands, Norway, Sweden, Singapore, and the United States—were recorded through November 10.
Key takeaways
- OpenSSH released emergency update 10.6p2 on November 5 to fix the SSHole authentication bypass vulnerability (CVE-2026-123158).
- Previdian detected attackers bypassing authentication to gain root access on a Linux honeypot within 9 hours of the release.
- Attackers executed reconnaissance commands via non-interactive SSH sessions, with 22 attempts recorded across 10 countries by November 10.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.