---
title: Hunt: Previdian saw SSHole (CVE-2026-123158) exploitation under nine hours after CVE publish — root on an Alpine honeypot from 89.116.89.18 | ctxsec
url: https://ctxsec.com/items/hunt-previdian-sshole-honeypot-root-89-116-89-18
description: "After this morning's watchTowr note that botnets/miners were already hitting the musl OpenSSH password bypass, Previdian reports its first attempt about 00:15 UTC Nov 6 (under nine hours after CVE-2026-123158 published), with confirmed root on a real Alpine/OpenSSH honeypot. Eight attempts, all from 89.116.89[.]18 (Japan), used oversized passwords and ran id/uname/hostname over non-interactive SSH. Previdian has listed the CVE on its own exploited feed; CISA KEV still has no SSHole entry (catalog remains 2026.11.04)."
status: "confirmed sensor observation (Previdian via Help Net Security / The Hacker News, Nov 6); not in CISA KEV as of catalog 2026.11.04"
published: 2026-11-06
---

> After this morning's watchTowr note that botnets/miners were already hitting the musl OpenSSH password bypass, Previdian reports its first attempt about 00:15 UTC Nov 6 (under nine hours after CVE-2026-123158 published), with confirmed root on a real Alpine/OpenSSH honeypot. Eight attempts, all from 89.116.89[.]18 (Japan), used oversized passwords and ran id/uname/hostname over non-interactive SSH. Previdian has listed the CVE on its own exploited feed; CISA KEV still has no SSHole entry (catalog remains 2026.11.04).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-previdian-sshole-honeypot-root-89-116-89-18.md)

confirmed sensor observation (Previdian via Help Net Security / The Hacker News, Nov 6); not in CISA KEV as of catalog 2026.11.04

2026-11-06

### Hunt: Previdian saw SSHole (CVE-2026-123158) exploitation under nine hours after CVE publish — root on an Alpine honeypot from 89.116.89.18

- **IOC:** `89.116.89[.]18` — oversized-password SSH auth + recon commands.
- **Auth logs:** hunt `Accepted password for` on accounts that should be key-only or `*` in shadow (alpine, root, deploy users), especially with absurd password lengths.
- **Still do:** OpenSSH 10.6p2 / Alpine patched package **and restart sshd**, or `PasswordAuthentication no`.
- Treat unverified GitHub "PoCs" as hostile until reviewed.

Sources: [Help Net Security: OpenSSH flaw exploited in the wild just hours after disclosure (Nov 6)](https://www.helpnetsecurity.com/2026/11/06/openssh-sshole-cve-2026-123158-exploitation/) · [The Hacker News: Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure (Nov 6)](https://thehackernews.com/2026/11/hackers-exploited-openssh-sshole-flaw.html) · [Previdian KEV-style feed listing CVE-2026-123158](https://previdian.com/feed)