What SANS observed
The SANS Internet Storm Center reports an increase in SSH login attempts it associates with the vulnerability called Sshole, identified in its diary as CVE-2026-123158. The report is based on its Cowrie honeypot observations and was announced through its original RSS feed on 8 November at 15:44:33 UTC. It is not a count of compromised production systems. SANS diary
The distinction between long passwords and exploit attempts matters. The diary says its first actual Sshole exploit attempt arrived on 5 November. Earlier unusual password strings, including observations on 1 November, appeared to result from buggy scripts putting shell commands into the password field. Treating every long password as an exploit attempt would overstate the reported evidence. SANS observations
Limits of the telemetry
SANS says this collection retains only the first 255 characters of SSH passwords. That truncation constrains conclusions about the complete input an attacker sent. Its table counts recorded requests rather than unique attackers, successful compromises or victims. An increase in requests does not establish the prevalence of vulnerable software across the internet.
The author expects some login attempts to have succeeded against the honeypots and says further analysis will follow. That expectation is not a completed finding that production systems were compromised. This short report therefore does not supply an affected-product inventory or a verified fixed-version recommendation.
Defensive use
TIR recommends preserving the relevant authentication telemetry, checking which SSH implementation is deployed and consulting its vendor's advisory before selecting a fix. Use unusual authentication inputs as an investigation lead rather than a stand-alone attribution or compromise verdict. The scanning addresses in a historical diary are not automatically an exclusive or current blocklist.
