[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRW_agG28MStWfwLP4pXgBrx6W9Bj_ViLV79iwRX6gs0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"8df2eb5c-12d3-4723-9b9b-93a9454a0290","unpatched-openssh-flaw-lets-attackers-bypass-linux-password-authentication","49fc2673-d3ec-4b74-bd11-727baebfc545","Unpatched OpenSSH Flaw Lets Attackers Bypass Linux Password Authentication","A decade-old vulnerability in OpenSSH (CVE-2026-123158), nicknamed SSHole, allowed attackers to bypass password authentication entirely on Linux systems using the musl C library due to a flaw in the crypt() password-hashing function. Despite a patch being available in OpenSSH 10.6p2, exploitation accelerated rapidly after public proof-of-concept code appeared, underscoring how quickly threat actors weaponize newly disclosed vulnerabilities. Attackers leveraged access to deploy botnets and cryptocurrency miners via a Python implant, demonstrating the real-world damage that follows delayed patching. This incident highlights the critical importance of rapid patch deployment for internet-facing services, especially those handling authentication.","**Immediate actions:**\n- Upgrade all affected OpenSSH installations to version 10.6p2 or later without delay.\n- Identify and inventory all Linux systems using the musl C library with OpenSSH exposed to the internet.\n- Temporarily restrict SSH access to trusted IP ranges or place SSH behind a VPN until patching is complete.\n\n**Long-term improvements:**\n- Implement an emergency patching SLA (e.g., 24–72 hours) for critical authentication vulnerabilities on internet-facing services.\n- Maintain a continuously updated software inventory to rapidly identify affected assets when new CVEs are published.\n- Disable password-based SSH authentication in favour of public-key or certificate-based authentication to reduce the attack surface.\n\n**Detection measures:**\n- Deploy automated vulnerability scanning that flags unpatched SSH versions across all internet-facing hosts.\n- Monitor SSH authentication logs for anomalous login patterns, unexpected successful logins, or high failure-to-success ratios.\n- Alert on the presence of unexpected Python processes or outbound connections from servers running SSH services.",[12,13,14,15,16],"CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 2: Inventory and Control of Software Assets (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 RS.AN-03: Analysis of incidents","NIS2 Article 21(2)(e)",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 SI-2: Flaw Remediation":19,"NIST CSF 2.0 RS.AN-03: Analysis of incidents":20,"CIS Control 7: Continuous Vulnerability Management (v8)":21,"CIS Control 2: Inventory and Control of Software Assets (v8)":22},"This provision mandates security in acquisition, development, and maintenance including vulnerability handling, directly requiring operators to act on published CVEs like SSHole affecting critical services such as SSH.","SI-2 requires organisations to identify, report, and correct information system flaws within defined time frames, which would have driven timely application of the OpenSSH 10.6p2 patch.","Structured monitoring and analysis controls would have detected the anomalous SSH logins and Python implant activity earlier, limiting the blast radius of exploitation.","This control requires organisations to continuously assess and remediate vulnerabilities; applying it would have ensured the OpenSSH flaw was identified and patched before public exploits appeared.","Knowing which systems ran the vulnerable OpenSSH version on musl libc would have enabled rapid, targeted patching when the advisory was published.","published","2026-11-11T08:20:44.279894+00:00","2026-11-11T08:20:44.267+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fhackread.com\u002Fhackers-exploit-old-openssh-bypass-linux-logins\u002F","hackers-exploit-decade-old-openssh-flaw-to-bypass-linux-logins-d47a60","Hackers Exploit Decade-Old OpenSSH Flaw to Bypass Linux Logins",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":40,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]