[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

confirmed (watchTowr Intel observing exploitation Nov 6; Alpine advisory + OpenSSH 10.6p2 Nov 5; CVE-2026-123158 / CVSS 8.1 per SecurityWeek); not in CISA KEV as of catalog 2026.11.04

SSHole (CVE-2026-123158) is being exploited: watchTowr sees botnets and crypto miners hitting the OpenSSH musl password bypass

  • Who is hit: Alpine (3.16–3.24 and edge, and openssh-server without PAM or with UsePAM no), plus other musl/PAM-disabled builds such as OpenWrt, Buildroot and Yocto. openssh-server-pam with UsePAM yes is not affected.
  • Why it escalated overnight: Alpine's Nov 5 advisory said no exploitation had been seen yet. watchTowr's Nov 6 post flips that — scanning and opportunistic abuse are already running.
  • Immediate actions: upgrade openssh and restart sshd (package upgrade alone does not replace the running daemon), or set PasswordAuthentication no and restart. Prefer key-only auth going forward.
  • KEV: not listed in CISA's catalog as of 2026.11.04 (latest adds were Apple CVE-2024-27834 and WordPress CVE-2026-119977).

Sources: watchTowr on X: observing SSHole CVE-2026-123158 exploitation (Nov 6) · Alpine Linux: openssh-server password authentication bypass (Nov 5) · OpenSSH 10.6p2 release notes · SecurityWeek: OpenSSH rushes patches for SSHole (CVE-2026-123158)