SANS honeypots detect exploitation attempts targeting sshole flaw

SANS Internet Storm Center reports that evidence of exploitation of the sshole vulnerability is appearing in their honeypot data. The team notes that exploitation requires a password longer than 256 characters, but honeypot logs often record 255-byte passwords; attackers’ brute-force scripts sometimes proceed with login attempts without validating success, instead injecting commands or, less consistently, the username.

They observed so-called “sshole passwords”—strings of letters filling the 255-byte field, typically all A’s in upper- or lower-case. The researcher behind the diary suggests that exploitation of sshole began to be evident in the honeypots on 5 November, with ongoing activity into early November.

Separately, SonicWall on 3 November released patches for seven SonicOS vulnerabilities, one of which is already being exploited to bypass multi-factor authentication for SSL VPN logins. The bypass can occur when multiple authentication methods exist and one does not require MFA, allowing attackers to sidestep MFA protections for SSL VPN access.

Microsoft, meanwhile, patched a cloud-levelling authorization bypass in Entra in a weekend advisory, noting no exploitation had been observed at the time and that exploitation is considered less likely for this more complex vulnerability. Apiiro’s researchers reported that Anthropic’s Claude Code, when asked to remember credentials for API access, may save them in a .claude/settings.local.json file inside a hidden GitHub directory.

Apiiro found roughly 1,500 credential files in GitHub, and they recommend automated secret checks prior to GitHub transmission, though protections may not cover credentials stored in other repositories.