Attackers exploit new OpenSSH flaw within hours of its public disclosure

A newly disclosed vulnerability in OpenSSH, tracked as CVE-2026-123158, was already being exploited in the wild within hours of being made public, according to a report from Help Net Security on November 6. The flaw was fixed in OpenSSH version 10.6p2, released November 5, and specifically affects musl-based Linux systems, such as those running Alpine Linux, when the system is not using PAM for authentication. A security firm called Previdian reported that the very first exploitation attempt it detected arrived less than nine hours after the vulnerability was publicly disclosed. The firm confirmed that the attack successfully achieved root access on a honeypot system it was monitoring. In total, Previdian counted eight separate exploitation attempts, all originating from the same IP address, 89.116.89.18. The attacks worked by sending unusually long passwords, over 256 characters, to accounts that should never accept password-based authentication in the first place, exploiting the underlying flaw to bypass expected security behavior. The speed of this exploitation highlights how quickly attackers now move to weaponize newly published vulnerabilities, leaving administrators very little time to patch before real attacks begin.

Why it matters

A root-access exploit appearing within nine hours of disclosure shows how little time administrators now have to patch before attacks start.

Source: Help Net Security