CVE-2026-123158 'Sshole': How a New SSH Vulnerability Became a Botnet Dropper Campaign in Under 96 Hours
Beginning November 1, 2026, honeypot sensors tracked a sharp escalation in SSH exploit-scanning activity tied to CVE-2026-123158, dubbed 'Sshole,' a critical SSH authentication vulnerability. Observed attempts grew from 23 on November 1st to a peak of 713 on November 6th, with source IPs spanning at least nine ASNs across Europe, Asia, Central Asia, and the Americas. Attackers leveraged oversized SSH password fields—some carrying embedded shell commands to fetch and execute a botnet dropper binary (bot.x86_64) from an attacker-controlled host—indicating opportunistic mass exploitation by botnet operators within days of public disclosure. This incident exemplifies the accelerating weaponization window between CVE disclosure and mass exploitation campaigns. The multi-continent scanning infrastructure and embedded dropper payloads signal organized botnet operations, consistent with a broader 2026 trend in which threat actors automate exploitation of newly published SSH and network-edge vulnerabilities within 72–96 hours of public release.
Kill Chain
