SANS honeypots record rising attempts to exploit Sshole

SANS ISC reports a rise in attempts to exploit the sshole vulnerability (CVE-2026-123158) as honeypots running Cowrie observed an uptick in post‑login shell activity beginning on 1 November. The data, drawn from SSH password handling in their honeypots, indicates that longer passwords are uncommon in typical brute‑force campaigns, with early activity on 1 November showing password lengths that were not aligned with the exploit itself.

The team notes that some “passwords” appeared to be commands intended for the post‑login shell rather than genuine credentials, and in a few cases these buggy scripts actually executed, potentially via a crafted password string.

Ullrich provides raw scanner data, including a list of initial source IPs that appeared to probe for the vulnerability, with counts by IP and ASN. for example 213.86.169[.]133 (AS8220, COLT Technology Services Group Limited) and 152.233.50[.]185 (AS212238, CDNEXT Datacamp Limited), among others. The first verified exploit attempts were recorded on 5 November, initially using an all‑“A” password.

A typical sample observed in the data is a shell‑oriented command sequence beginning with cd /tmp and attempting to fetch a bot binary from http://156.238.252[.]37:8000/bot.x86_64 and place it in /tmp/b, with permissions set to 777. Ullrich notes that many login attempts may have succeeded on the honeypots, and promises further updates as data is processed.