|

Feds Order Fast Fixes as Hackers Abuse OpenSSH’s SSHole Bug

CISA adds OpenSSH’s SSHole login bypass to its exploited-flaws list as attackers hunt root SSH keys and plant backdoors on Linux servers.
Content Team
By Content Team

Hackers are already abusing SSHole, an OpenSSH login bypass on Linux tracked as CVE-2026-123158. On Monday, CISA put it on its list of flaws known to be exploited, along with bugs in GPUStack, SignalWire FreeSwitch and IBM Aspera Faspex.

GreyNoise spotted its first SSHole attack on November 7. Across 18 attack chains, intruders hunted for password hashes and root SSH keys, then tried slipping their own keys into authorized_keys to keep access. One crew dropped TAC Agent, a Python remote-control tool. watchTowr links other activity to botnets and crypto miners.

US federal agencies must patch by November 12.

Source: The Hacker News
Share this article
Share on facebook Share on linkedin Share on twitter Share on email
blog_book_a_demo_cta_3x
Have questions about protecting your software?
Our escrow experts are standing by to help.
Book a free demo
YOU MAY ALSO LIKE
Cyberattacks
Jailbroken DeepSeek Agent Ran a Telecom Hack Mostly Unsupervised
Nov 10, 2026
Vulnerabilities
SonicWall Warns of Actively Exploited SSLVPN Flaw That Can Bypass MFA
Nov 9, 2026
Vulnerabilities
CISA Gives Agencies Three Days to Patch Exploited WordPress Flaw
Nov 5, 2026
Cyberattacks
Bitter Spy Group Rewrites Malware in Rust for South Asia Attacks
Nov 3, 2026