The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added four security flaws impacting GPUStack, SignalWire FreeSwitch, OpenBSD OpenSSH, and IBM Aspera Faspex to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation.

The addition of CVE-2026-123158 to the KEV catalog follows reports of exploitation attempts targeting the flaw since November 6, 2026. A total of 22 exploitation attempts have been recorded from 14 unique IP addresses so far, according to Previdian.

In a post shared on X on November 7, 2026, Defused Cyber said it "observed a small amount of actors targeting SSHole" but stressed the exploitation activity is not widespread yet.

According to GreyNoise, the first exploitation attempt against its honeypot network was observed on November 7, 2026, at 12:46 a.m. UTC. Confirmed post-exploitation activity has been detected from six source IP addresses, representing 18 distinct attack chains to date.

These involve reconnaissance, queries to cloud metadata services, attempts to read password hashes and root SSH keys, and efforts to modify the SSH authorized_keys file to gain persistent access.

In at least one case, unknown threat actors have been observed deploying TAC Agent, a Python-based command-and-control (C2) agent capable of shell command execution, system reconnaissance, directory enumeration, file transfer, and updating itself.

Threat intelligence firm watchTowr said it has also observed the OpenSSH flaw being weaponized in the wild for botnet and cryptocurrency miner activity.

In an advisory for CVE-2026-102895 published on July 31, 2026, the maintainers of the GPUStack Python package credited Nikko Enggaliano, Wei Yunzhou, Rui Yang, and Haoyu Wang for independently reporting the flaw, adding that "active in-the-wild exploitation" was reported by Ulex Innovative Systems' Javier Sixto.

Source link