SSHole exploited within hours of its November 5 fix

SSHole lets an oversized password log you in

An oversized password is enough to log in to some Linux machines this week. CVE-2026-123158, codenamed SSHole and disclosed by researcher Ozgun Kultekin, turns a deliberately locked account into an open one on OpenSSH builds that use the musl C library with PAM disabled. musl’s password-hashing function returns the string * when it errors, and an over-long password forces that error. OpenSSH compares the returned * to the account’s stored hash, and an account locked against password login holds exactly that value, a lone *, in /etc/shadow. The two match, the login succeeds, and if the account carries passwordless administrative rights the attacker lands as root. Accounts with real password hashes are unaffected.

Alpine ships OpenSSH in the affected configuration by default, and it is the lightweight distribution used across cloud and virtual environments. OpenSSH fixed it in 10.6p2 on November 5. Exploit code followed in roughly four hours, and exploitation attempts started the same day, with the first successful compromises the next. GreyNoise recorded its first confirmed in-the-wild success on November 7 at 00:46 UTC, about 40 hours after the fix shipped. Previdian reported 20 attempts from 13 IPs across nine countries, and watchTower saw SSHole folded into botnet and cryptomining activity on November 6.

What the intruders do once in is ordinary post-exploitation. GreyNoise logged 16 successful chains from six source IPs: system and container reconnaissance, calls to cloud metadata services, attempts to read password hashes and root SSH keys, and edits to authorized_keys for persistence. One actor reached root and dropped TAC Agent, a Python command-and-control implant that supports shell execution, reconnaissance, file transfer and self-update but has no built-in persistence, so the attackers tried to secure it by configuring a startup service. That sample never reached its C2 at tac.vpnla[.]org and never got a task. Its comments and logs are in Chinese. GreyNoise also noted that a missing-tool check returned feedback an automated planner could act on, which points at machine-driven operation.

If you run musl-based OpenSSH with PAM off, update to 10.6p2 or disable SSH password authentication. Then look backward: check for successful password logins to any account whose /etc/shadow field is *, for SSH keys you did not add, and for TAC Agent files or stray startup services.

The updater is the payload

Three separate items this week put the backdoor inside the thing meant to keep a system current or safe.

XLab documented CWPdoor, a Linux backdoor delivered by replacing cwpsrv, the daemon and web server behind Control Web Panel. A script named cwpsrv_update.sh pulls a trojanized cwpsrv from 136.0.141[.]71 and swaps it for the real binary. The replacement is a passive backdoor: it waits for a specific header in HTTP or HTTPS traffic, runs the attacker’s command, and suppresses logging for that one request, so nothing lands in the access logs.

cPGuard’s maker, OPSSHIELD, said an attacker used compromised credentials to log into a customer account on its billing app at manage.opsshield[.]com, reached the update distribution CDN behind it, and pushed a malicious script down the cPGuard update channel at 02:06 UTC on November 2.

And CVE-2026-109518 (CVSS 7.7) lets a network-positioned attacker feed Debian and Ubuntu a package that never passed verification. Per Amazon’s advisory, when APT is set to use HTTP package sources with retries enabled, someone between the host and the mirror can make APT install such a package, after which its maintainer scripts run as root. The fix across all three is the same old discipline: verify what the update channel hands you, keep package sources on HTTPS, and watch the binaries your package tooling replaces.

AI on both ends

CERT-In flagged an AI-assisted actor it tracks as Crafty Falcon re-hitting Indian banking, financial-services and insurance firms that had only partly remediated an earlier intrusion, timing the return for holidays, weekends and other low-monitoring windows. Acronis described a single operator running BOSSAI, a mesh of 12 agents built from tools including HexStrike AI, Hermes, CyberStrikeAI and HalberdStrike alongside Grok, OpenClaw and Claude Code, with some agents building infrastructure and others scanning and attacking. That one person, believed to be based in Hualien City, Taiwan, hit hundreds of organizations across government emergency services, banks, universities, military systems and more in eleven countries.

The models are targets too. RunSybil disclosed a memory-safety flaw in the CPython interpreter that lets an attacker escape a code sandbox and run code hidden in a crafted model, a route into the servers that host AI workloads and the cloud infrastructure under them. It builds on an earlier out-of-bounds read in CPython. That one has been fixed and backported to the 3.13, 3.14 and 3.15 branches, so update the interpreter wherever you run untrusted model code.