SANS Internet Storm Center has added a separate view of SSHole probing, reporting suspicious SSH logins captured by its Cowrie honeypots. The November 8 diary also exposes a measurement problem: the sensors retain only the first 255 characters of submitted passwords.
Johannes Ullrich identifies November 5 as the first actual SSHole attempt in that dataset, using a password made entirely of the letter A. Earlier long entries, starting November 1, appeared to be malfunctioning scripts putting shell commands into the password field.
The diary’s daily series includes 713 long-password requests on November 6. That figure includes the broader long-password activity, rather than a verified count of successful SSHole exploits. The report’s capture limit also prevents inspection of complete oversized passwords.
For defenders, this is a reminder to distinguish what a sensor records from what an attacker achieves. A truncated field can hide information needed to classify a request. A counter can combine different behaviors. Neither should be converted directly into a claim about breached organizations.
Keep the sensor evidence separate from confirmed access
DaySec previously covered Previdian’s report of root access on an Alpine Linux honeypot. The new SANS observations come from a different collection system; their counts should not be merged into a single victim total. Previdian’s own public record warns that its attempt telemetry does not establish successful exploitation.
CVE-2026-123158 concerns specific Linux OpenSSH configurations using musl without PAM-based authentication. Alpine’s advisory describes additional account and password-hash prerequisites, so an exposed SSH port alone does not establish vulnerability.
OpenSSH 10.6p2, released November 5, adds a workaround for the authentication bypass. Alpine also provides patched package revisions for its distribution branches.
Administrators should follow the distribution’s patched-package guidance and restart sshd after upgrading; replacing the package alone leaves the old daemon running. If updating must wait, Alpine recommends disabling password authentication and restarting the service, after confirming key-based access works.
For monitoring teams reviewing this activity, the useful questions are how each event was classified, which fields were truncated, and whether host evidence corroborates a login. Those checks make the telemetry actionable without overstating what the dataset can prove.
