Threat video1:00
CVE-2026-123158 OpenSSH musl Bypass: Detection & IOCs
Exploitation began hours after disclosure; GreyNoise saw SSH key implants and a Python C2 agent. Has 9 detection rules, incl. free Splunk SPL, and 21 IOCs.
Read the full threat intel for CVE-2026-123158 OpenSSH musl Bypass: Detection & IOCs →
Chapters
- 0:00The hookExploits hit within hours of disclosure.
- 0:04The storyA public exploit came before CVE.
- 0:10Attack pathLocked accounts still accepted logins.
- 0:24AttributionNo threat actor: this was defensive research.
- 0:29Indicators of compromise20 indicators to hunt: 14 IPs, 1 domain and 3 SHA-256 hashes, and more.
- 0:38MITRE ATT&CK techniques16 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation6 steps now: Upgrade OpenSSH to 10.6p2 or the distro-fixed package.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Exploits hit within hours of disclosure.
0:05A public exploit came before CVE.
0:07Then exploitation succeeded.
0:11Locked accounts still accepted logins.
0:13Passwordless doas gave root.
0:15An SSH key was planted.
0:17Python and TAC Agent staged.
0:20Command and control agent followed.
0:25No threat actor: this was defensive research.
0:2920 indicators to hunt: 14 IPs, 1 domain and 3 SHA-256 hashes, and more.
0:3816 ATT&CK techniques, from reconnaissance to command and control.
0:436 steps now: Upgrade OpenSSH to 10.6p2 or the distro-fixed package.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.