CISA, the U.S. cyber defence agency, added four flaws to its list of known exploited vulnerabilities, citing evidence of active attacks. The Hacker News reported the move came on Monday. The products are GPUStack, SignalWire FreeSWITCH, OpenBSD OpenSSH and IBM Aspera Faspex. The OpenSSH flaw, CVE-2026-123158, is nicknamed SSHole. It can let an attacker skip login on Linux. Previdian counted 22 attack attempts from 14 IP addresses since November 6. GreyNoise saw its first attempt on a decoy system on November 7, and confirmed break-in activity from six addresses. watchTowr said attackers are using the flaw for botnets and cryptocurrency mining.
Public attack details exist only for OpenSSH. The Hacker News said no public reports yet show how the other three flaws are used, who is behind the attacks, or how large they are. Defused Cyber said on November 7 that few attackers were targeting SSHole and that the activity was not widespread. The Hacker News listed fixes for all four: GPUStack in July, FreeSWITCH in October, and OpenSSH and IBM in November.
Teams that run any of these products should confirm the fixes are installed. CISA urges all organisations, not only federal ones, to fix listed flaws first. The Hacker News said federal civilian agencies are advised to apply the fixes by November 12.