Linux SSH flaw '*sshole' now under active attack
Original: Vulnerability that lets hackers SSH into Linux devices is under active exploitation
Why This Matters
Unauthenticated root-level SSH access at scale is a worst-case scenario for Linux server security.
CVE-2026-123158, dubbed '*sshole', lets unauthenticated attackers access privileged Linux accounts via OpenSSH and musl. Active exploitation began within 4 days of disclosure, with group GT10 deploying an AI-generated backdoor.
A critical vulnerability named '*sshole' (CVE-2026-123158) is being actively exploited just four days after public disclosure, with multiple security firms confirming real-world attacks. The flaw lives in the interaction between OpenSSH and musl, a lightweight alternative to the standard libc library. When PAM is disabled and certain password configurations are present — specifically, accounts using SHA256/SHA512 hashing alongside passwordless accounts marked with '*' in /etc/shadow — an attacker can trigger the bug by submitting a password longer than 256 characters. The oversized input causes musl's hashing function to return '*', which OpenSSH then misinterprets as a valid match, granting unauthenticated access to high-privilege accounts in seconds.
Greynoise reported Monday that its Southeast Asia honeypots were hit by a group it tracks as GT10, describing the intrusions as 'mature.' Access to a GT10 server revealed additional potential victims and tools, including a backdoor called TAC Agent — which carries Chinese-language comments and appears AI-generated. TAC Agent supports shell commands, system reconnaissance, and persistence. The attackers also install Python3 on compromised machines to run it. Separately, watchTowr flagged botnet and crypto-related exploitation activity on Friday; Previdian recorded 20 exploitation attempts from 13 unique IPs across nine countries. OpenSSH has released a patch.