{"id":246783,"date":"2026-11-07T02:42:49","date_gmt":"2026-11-07T08:42:49","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/11\/hackers-target-openssh-sshole-flaw-within-hours-of-disclosure-gain-root-on-honeypot"},"modified":"2026-11-07T02:42:49","modified_gmt":"2026-11-07T08:42:49","slug":"hackers-target-openssh-sshole-flaw-within-hours-of-disclosure-gain-root-on-honeypot","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/11\/hackers-target-openssh-sshole-flaw-within-hours-of-disclosure-gain-root-on-honeypot","title":{"rendered":"Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot"},"content":{"rendered":"\n<p>\u201cThe observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions,\u201d Ryan Dewhurst, founder and CEO of Previdian, said in a statement shared with The Hacker News.<\/p>\n<p>Affected users are advised to install OpenSSH 10.6p2 or their distribution\u2019s patched package, and then restart sshd. Alpine is also recommending that users investigate \u201cAccepted password for\u201d log entries involving accounts that should not accept password logins.<\/p>\n<p>\u201cLook in \/var\/log\/messages for sshd lines reading Accepted password for an account that has no password (alpine, root, or any key-only user),\u201d Alpine <a href=\"https:\/\/alpinelinux.org\/posts\/2026-11-05-openssh-password-authentication-bypass\/\" target=\"_blank\">said<\/a>. \u201cReview doas use and recently created users, files and authorized keys on exposed machines. If you cannot rule out a login, treat the machine as compromised.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u201cThe observed source IP, 89.116.89[.]18, used oversized passwords to bypass authentication and ran reconnaissance commands including id, uname and hostname through non-interactive SSH sessions,\u201d Ryan Dewhurst, founder and CEO of Previdian, said in a statement shared with The Hacker News. Affected users are advised to install OpenSSH 10.6p2 or their distribution\u2019s patched package, and then [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1492],"tags":[],"class_list":["post-246783","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246783","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=246783"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/246783\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=246783"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=246783"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=246783"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}