SANS ISC: SSHole (CVE-2026-123158) exploit attempts on its SSH honeypots rose from Nov 4 and peaked Nov 6

official research (SANS Internet Storm Center honeypot data, Nov 8); counts come from one honeypot set and are not an Internet-wide total2026-11-08

What ISC measured: its honeypots log only the first 255 characters of an SSH password, so its view is limited. Long passwords are rare in normal brute-forcing, so it used them as the signal. Daily long-password counts: Nov 1: 23, Nov 2: 0, Nov 3: 5, Nov 4: 58, Nov 5: 232, Nov 6: 713, Nov 7: 246, Nov 8: 51 (the Nov 8 figure was published mid-day).
Not all of it is SSHole: ISC says the Nov 1 entries do not appear to relate to the exploit. They look like buggy brute-force scripts that paste shell commands, such as a wget/curl download of a bot.x86_64 binary, into the password field.
First exploit attempts: Nov 5, using an all-"A" password. The top early source networks included COLT, Datacamp, Server-Mania and DMZHOST, along with several Korea Telecom addresses. ISC publishes the full source list.
Still to come: ISC expects many attempts succeeded against its honeypots and says it will follow up with details extracted from them.
What to do: patching and exposure guidance is in our earlier SSHole items. This post is scan and exploitation telemetry, not a new vulnerability.