// ARS TECHNICA — CYBERSECURITY
Vulnerability that lets hackers SSH into Linux devices is under active exploitation
“*sshole” poses a serious threat to Internet security.
Hackers are actively exploiting a recently discovered critical vulnerability that allows them to log in to privileged accounts on many Linux systems, multiple researchers are reporting.
The vulnerability, tracked under the name *sshole, arises from the interaction between OpenSSH and a code library known as musl. Linux systems that use both of these packages and meet certain other requirements can be hacked to give unauthenticated access to high-privilege accounts in a matter of seconds. *sshole became publicly known last Thursday and quickly stoked concerns it could lead to widespread compromise of Linux machines. Four days later, the prediction shows signs of becoming real.
Security firm Greynoise said Monday that honeypots it maintains in Southeast Asia have come under attack by a group it’s tracking as GT10. The group conducted “mature intrusions” into the systems, which Greynoise uses to detect attempted or successful attacks in real time. Greynoise subsequently gained access to a GT10 server that revealed potential other victims and some of the tools used in the campaign. A backdoor the group is using in the attacks contains Chinese language comments and appears to be generated with the use of AI.
Greynoise said that GT10 is also installing the Python3 release on machines that don’t already have it because the package is required to run the hacker’s backdoor, which is tracked under the name TAC Agent. TAC Agent supports a wide range of functions, including shell commands, system reconnaissance, and persistence. OpenSSH has released a fix that prevents attacks from working.
Researchers at security firm watchTowr said Friday that they, too, were seeing exploitation activity, which was related to botnets and cryptocurrency. Security firm Previdian has also reported similar activity. It said its company’s sensors have seen 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.
The vulnerability, tracked as CVE-2026-123158, resides in OpenSSH, when it runs alongside musl, a Linux alternative to the widely used libc code library. Further, OpenSSH must not use PAM (pluggable authentication modules), a framework that handles user authentication and account access checks. Additionally, SSH configurations must (1) have at least one account that’s accessible using a password that is hashed using the SHA256 or SHA512 function and (2) also be set to use passwordless accounts by way of specifying a “*” in the password field in the /etc/shadow file. Passwordless configurations are standard for certain types of accounts.
Exploits are triggered when an attacker enters passwords with more than 256 characters for a passwordless account. This step occurs when the OpenSSH server hashes the supplied password and checks it against the hash stored in /etc/shadow. The oversized password produces an error that causes musl’s password hashing function to return “*”. The attacks exploit the “misinterpretation of whether a string is intended to be a password hash,” Red Hat said.
Despite the multiple conditions necessary, CVE-2026-123158 poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight distribution of Linux. The ease of exploitation allows hackers to direct malicious commands to any of the millions of SSH servers exposed to the Internet and identify potentially vulnerable ones in seconds. Anyone using OpenSSH should install the update promptly. Those using musl should investigate further.