Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot

Executive Summary

Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set, according to Previdian.

The vulnerability, tracked as CVE-2026-123158 (CVSS score: 8.1) and codenamed SSHole (or *sshole), impacts Linux systems that run OpenSSH on the musl C library with Pluggable Authentication Modules (PAM) disabled,

Key Risk Indicators

• Dangling CNAME Vulnerabilities: When cloud services (S3, Azure Front Door, GitHub Pages, Heroku) are decommissioned without removing corresponding DNS records, adversaries can claim the unclaimed cloud resource.
• Authentication Cookie Exposure: Compromised subdomains can read root-level domain session cookies, enabling account takeover and CSRF bypass across primary applications.
• Automated Fleet Audit Cadence: Organizations must maintain active CNAME NXDOMAIN verification across all managed production and staging domains.

Actionable Remediation Checklist

• ☐ Audit all CNAME records for unresolved target hostnames or deprovisioned cloud endpoints.
• ☐ Enforce automated DNS change management that removes DNS pointers before deallocating cloud infrastructure.
• ☐ Deploy continuous external subdomain takeover monitors with immediate webhook escalation.