Update to my *sshole write-up and the emergency patch post. The Hacker News reports Previdian saw exploitation attempts less than nine hours after CVE-2026-123158 published, and confirmed root on an Alpine/OpenSSH honeypot.
What’s new
- Eight attempts from a Japan-geolocated IP using oversized passwords
- Post-login recon: id, uname, hostname over non-interactive SSH
- Still musl + PAM-disabled OpenSSH; fixed in OpenSSH 10.6p2
- Alpine: hunt “Accepted password for” on accounts that should be key-only
My take
Nine hours is not a leisurely patch window. Upgrade, restart sshd, and treat unexplained password accepts on locked accounts as compromise until proven otherwise.
God Bless, and May the Source Be with You!
