A follow-up to my earlier SSHole post. The SANS Internet Storm Center published honeypot data on attempts to exploit the OpenSSH “SSHole” flaw (CVE-2026-123158).
What they see
Their Cowrie honeypots log the first 255 characters of SSH passwords, and long passwords are rare in normal brute forcing, so they make a decent signal. The first real exploit attempts, all-“A” passwords, showed up on Nov. 5. Daily counts of long-password attempts:
- Nov. 4: 58
- Nov. 5: 232
- Nov. 6: 713
- Nov. 7: 246
- Nov. 8 (partial): 51
The early hits on Nov. 1 weren’t SSHole at all. They were buggy brute-force scripts stuffing post-login download commands into the password field.
My take
The spike has dropped, but the scanning hasn’t stopped. If you haven’t patched OpenSSH yet, do it now, and check your build with my SSHole how-to.
God Bless, and May the Source Be with You!
