SANS honeypots log first sshole exploit attempts, mostly from a handful of scanners
Cowrie sensors saw long-password logins climb from 23 on November 1 to 713 on November 6, with the first real exploit attempt arriving November 5.
SANS Internet Storm Center says its Cowrie honeypots are now seeing attempts to exploit the "sshole" bug in OpenSSH, a week after it became public. The write-up, dated Sunday November 8, tracks long-password SSH logins rising from 23 on November 1 to 713 on November 6, then falling back to 246 on November 7 and 51 on November 8.
The sensors only keep the first 255 characters of a password, which is a real limit here: the flaw needs passwords between 256 and 1024 characters. So the counts are a floor, not a tally of successful attacks.
The first attempts that look like the actual exploit arrived on November 5, using an all-"A" password. Earlier long passwords on November 1 look unrelated: buggy brute-force scripts dropping shell commands into the password field. Ullrich notes those may have worked anyway.
Scanners came from a short list of addresses, with 213.86.169.133 (AS8220) and 152.233.50.185 (AS212238) the busiest. He expects some honeypot logins succeeded and says he'll follow up.
The bug affects sshd before 10.6p2 on Linux with musl libc and no PAM, Alpine being the example given. If that's your setup, the release notes are the place to start.
CVE references
Sources
- Scans for Sshole Vulnerability (CVE-2026-123158), (Sun, Nov 8th)Primaryisc.sans.edu
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning
