[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Threat Hunting · markdown

confirmed sensor observation (Previdian via Help Net Security / The Hacker News, Nov 6); not in CISA KEV as of catalog 2026.11.04

Hunt: Previdian saw SSHole (CVE-2026-123158) exploitation under nine hours after CVE publish — root on an Alpine honeypot from 89.116.89.18

  • IOC: 89.116.89[.]18 — oversized-password SSH auth + recon commands.
  • Auth logs: hunt Accepted password for on accounts that should be key-only or * in shadow (alpine, root, deploy users), especially with absurd password lengths.
  • Still do: OpenSSH 10.6p2 / Alpine patched package and restart sshd, or PasswordAuthentication no.
  • Treat unverified GitHub "PoCs" as hostile until reviewed.

Sources: Help Net Security: OpenSSH flaw exploited in the wild just hours after disclosure (Nov 6) · The Hacker News: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure (Nov 6) · Previdian KEV-style feed listing CVE-2026-123158