Actively exploited SSHole flaw puts OpenSSH servers on same-day clock

Attackers are actively exploiting the "SSHole" vulnerability in OpenSSH (CVE-2026-123158) to execute commands, steal credentials, and establish persistent access. BleepingComputer has reported real-world intrusions, confirming this is not a theoretical risk. OpenSSH is the default remote access pathway on Linux servers, and a flaw in it effectively leaves the front door open — for sysadmins and SREs managing production hosts, this is a same-day priority.

What the attackers are doing

According to BleepingComputer's reporting, the intrusion pattern includes:

  • Remote code execution: running arbitrary commands on affected hosts
  • Credential theft: harvesting SSH keys and session credentials
  • Persistence: planting backdoors or modifying authorized_keys so access survives a reboot

Taken together, these three capabilities undermine the assumption that patching alone resolves the problem. If a host has already been compromised, applying the patch merely closes the door after the fact — the attacker may already be inside.

Which systems are at risk

Any OpenSSH server exposed to the public internet or an internal network falls within scope, including jump boxes, bastion hosts, CI runners, Kubernetes nodes, NAS devices, and the large population of legacy VMs that rarely receive attention.

Note that BleepingComputer's report does not specify exact affected or fixed version ranges, and provides no CVSS score. We have deliberately chosen not to estimate either — consult the official advisory for your distribution as the authoritative reference. Most distributions (Debian, Ubuntu, RHEL, Alpine, and others) backport the fix, so there is no need to compile upstream source; updating through your package manager is sufficient.

Priority order: same-day action list

  1. Patch: run apt upgrade or dnf update for openssh-server and openssh-clients immediately, then restart sshd.
  2. Lock down authentication: confirm PasswordAuthentication no and PermitRootLogin no (or prohibit-password), leaving only key-based login enabled.
  3. Reduce attack surface: restrict port 22 behind a firewall or security-group allowlist rather than exposing it to the entire network; consider changing the port or adding MFA/fail2ban on jump boxes.
  4. Assume breach: hosts that remained unpatched over a long uptime window should be treated as potentially compromised — rotate SSH keys, user passwords, and CI secrets, and audit authorized_keys.

Checking whether you have been compromised

# Recent logins and their source addresses
last -F | head -50

# authorized_keys modified in the last 30 days
find / -name authorized_keys -mtime -30 -exec ls -l {} \;

# Suspicious processes / reverse shells
ps auxf | egrep 'nc |bash -i|/dev/tcp'

# Verify the sshd package has not been tampered with
rpm -V openssh-server 2>/dev/null || dpkg -V openssh-server 2>/dev/null

# Audit recent SSH logins
grep -E 'Accepted|Failed' /var/log/auth.log | tail -100

If any output looks irregular, treat the host as an incident — a reboot alone is not an adequate response.

Why this matters

SSH is the entry point to nearly every Linux server in production. Attackers combining remote code execution, credential theft, and persistence against it can move laterally from one host to the next. For teams managing distributed infrastructure, jump hosts, and CI/bastion environments across Hong Kong and the surrounding region, unpatched OpenSSH hosts represent the most direct starting point for blast radius. In addition to following your distribution's advisory, consult HKCERT and your vendors' published vulnerability notes to align on affected versions before running an inventory.

Source: BleepingComputer

遭 actively exploited 的 SSHole 漏洞令 OpenSSH 伺服器面臨即日修補期限

攻擊者正 actively exploiting OpenSSH 的「SSHole」漏洞（CVE-2026-123158），藉此執行指令、竊取 credentials，以及建立持久存取權限。BleepingComputer 已報道實際入侵案例，證實此舉並非只屬理論風險。OpenSSH 是 Linux 伺服器的預設 remote access 途徑，其漏洞一旦出現，等同前門大開——對管理 production host 的 sysadmin 及 SRE 而言，此事應列為即日處理的優先事項。

攻擊者的行為模式

根據 BleepingComputer 的報道，入侵手法包括：

  • Remote code execution：在受影響的主機上執行任意指令
  • Credential theft：搜集 SSH keys 及 session credentials
  • Persistence：植入 backdoor 或修改 authorized_keys，令存取權限在系統重新啟動後依然有效

三者結合，動搖了「只要完成 patch 即可解決問題」的假設。倘若主機已被入侵，套用補丁只屬事後關門——攻擊者可能早已身在其中。

哪些系統有風險

任何對公網或內部網絡暴露的 OpenSSH server 均在影響範圍之內，包括 jump box、bastion host、CI runner、Kubernetes node、NAS 裝置，以及長期無人處理的大量 legacy VM。

須留意：BleepingComputer 的報道並未列明確切的受影響或已修訂版本範圍，亦未提供 CVSS 分數。本文特意不作估算——請以所用 distribution 的官方 advisory 作為權威依據。多數 distribution（Debian、Ubuntu、RHEL、Alpine 等）均以 backport 方式提供修補，因此無須自行編譯 upstream source，透過 package manager 更新即可。

優先次序：即日行動清單

  1. Patch：立即以 apt upgrade 或 dnf update 更新 openssh-server 及 openssh-clients，其後 restart sshd。
  2. Lock down authentication：確認 PasswordAuthentication no 及 PermitRootLogin no（或 prohibit-password），只保留 key-based login。
  3. Reduce attack surface：以 firewall 或 security group allowlist 限制 port 22，不應對整個網絡開放；jump box 宜考慮更改 port 或加設 MFA／fail2ban。
  4. Assume breach：長期 uptime 而未經 patch 的主機，應視為可能已被入侵——輪換 SSH keys、user passwords 及 CI secrets，並審核 authorized_keys。

檢查是否已遭入侵

# 最近的 logins 及其來源地址
last -F | head -50

# 最近 30 日內改動過的 authorized_keys
find / -name authorized_keys -mtime -30 -exec ls -l {} \;

# 可疑 process 及 reverse shell
ps auxf | egrep 'nc |bash -i|/dev/tcp'

# 確認 sshd package 未遭人為竄改
rpm -V openssh-server 2>/dev/null || dpkg -V openssh-server 2>/dev/null

# 審核最近的 SSH logins
grep -E 'Accepted|Failed' /var/log/auth.log | tail -100

任何一條輸出看來異常，即應將主機視為安全事故處理——僅重新啟動並不足夠。

事件的重要性

SSH 幾乎是每一台生產環境 Linux 伺服器的入口。攻擊者結合 remote code execution、credential theft 及 persistence，可由一部主機橫向移動至另一部。對於在香港及周邊地區管理 distributed infrastructure、jump hosts 及 CI／bastion 環境的團隊而言，未經 patch 的 OpenSSH 主機是 blast radius 最直接的起點。除跟隨所用 distribution 的 advisory 外，亦應查閱 HKCERT 及各供應商 published vulnerability notes，先就 affected versions 取得一致，再進行 inventory。

Source: BleepingComputer

新聞來源 / Original News Source