The short version
- Multiple security firms have confirmed active exploitation of a critical vulnerability known as *sshole affecting Linux systems that combine OpenSSH with the musl library.
- Attackers are using the flaw to install persistent backdoors and deploy cryptocurrency mining botnets, with significant activity detected in Southeast Asia.
- The exploit targets specific configuration settings involving passwordless accounts and SHA256 or SHA512 hashing, allowing unauthenticated access within seconds.
A severe security vulnerability affecting Linux systems is currently being exploited by cybercriminal groups to gain unauthorized access to privileged accounts. The flaw, identified as CVE-2026-123158 and colloquially referred to as *sshole, allows attackers to bypass authentication mechanisms on devices running OpenSSH alongside the musl code library. Security researchers report that the exploitation is not merely theoretical but is actively occurring in the wild, with multiple firms detecting coordinated attacks against vulnerable infrastructure.
The technical conditions required for the exploit are specific yet common enough to pose a widespread risk. The vulnerability exists when OpenSSH operates without Pluggable Authentication Modules and interacts with musl, an alternative to the standard libc library. Furthermore, the system must have at least one account accessible via a password hashed using SHA256 or SHA512 functions, while also containing passwordless accounts designated by an asterisk in the shadow file. These configurations are standard for certain administrative and service accounts, making many servers susceptible.
The attack mechanism relies on sending oversized passwords to these passwordless accounts. When an attacker inputs a string exceeding 256 characters, the OpenSSH server attempts to hash the input and compare it against stored credentials. This process triggers an error in musl’s hashing function, causing it to return an asterisk. The system misinterprets this result as a valid match for the passwordless account, thereby granting immediate access. Red Hat described this as a misinterpretation of whether a string represents a password hash, highlighting the fundamental flaw in how the interaction is handled.
Security firm Greynoise reported that honeypots located in Southeast Asia have been targeted by a group tracked as GT10. These intrusions were characterized as mature and sophisticated, indicating organized effort rather than opportunistic scanning. By gaining access to a server controlled by GT10, researchers identified tools used in the campaign, including a backdoor containing Chinese language comments. The presence of these comments and the structure of the code suggest that artificial intelligence may have been utilized to generate the malicious software.
The primary objective of these intrusions appears to be the installation of a persistent backdoor known as TAC Agent. To ensure this tool functions correctly, attackers are installing Python3 on compromised machines if it is not already present. Once deployed, TAC Agent provides a wide range of capabilities for the attackers, including the ability to execute shell commands, conduct system reconnaissance, and maintain long-term access to the infected devices. This level of control allows threat actors to pivot within networks or use the compromised systems as part of larger botnets.
Other security organizations have corroborated these findings with their own data. Researchers at watchTowr observed exploitation activity linked to botnet operations and cryptocurrency mining, suggesting a financial motive behind the attacks. Similarly, Previdian reported detecting twenty exploitation attempts originating from thirteen unique IP addresses geolocated across nine different countries. The geographic distribution of the attack sources indicates a broad and decentralized effort to identify and compromise vulnerable systems.
The ease with which this vulnerability can be exploited raises significant concerns for internet security. Attackers can scan millions of exposed SSH servers in seconds to identify those meeting the specific criteria for exploitation. Alpine Linux, a lightweight distribution that frequently uses musl, is particularly at risk due to its prevalence in containerized environments and embedded systems. The speed of compromise means that even brief exposure windows can result in full system takeover.
OpenSSH has released a patch to address CVE-2026-123158, effectively preventing the attack vector from succeeding. Security experts urge all administrators using OpenSSH to apply this update immediately. For systems utilizing musl, further investigation is recommended to determine if the specific configuration requirements for the exploit are present. Given the active nature of the threat and the sophistication of the attacking groups, delaying remediation could lead to significant data breaches or infrastructure disruption.
The incident underscores the ongoing challenges in maintaining secure configurations across diverse Linux environments. While the vulnerability requires a specific combination of software components and settings, its impact is severe due to the critical nature of SSH access. As organizations rush to patch their systems, the focus remains on identifying any machines that may have already been compromised before the fix was applied. The use of AI-generated tools by threat actors also signals an evolving landscape in cyber warfare, requiring updated detection strategies.
Moving forward, monitoring for signs of TAC Agent or unusual Python installations will be crucial for detecting post-exploitation activity. Security teams should review logs for any unauthorized access attempts involving oversized password strings, which may indicate prior exploitation efforts. The rapid transition from disclosure to active exploitation highlights the importance of timely patch management and continuous vulnerability assessment in protecting critical digital infrastructure.
Sources behind this briefing
Go to the original reporting
- Ars Technica↗Vulnerability that lets hackers SSH into Linux devices is under active exploitation
