Vulnerability that lets hackers SSH into Linux devices is under active exploitation

Your Linux devices can be compromised through SSH without authentication if not updated.

A critical vulnerability, nicknamed "*sshole" and identified as CVE-2026-123158, is being actively exploited by hackers to gain privileged access to Linux devices. The flaw arises from an interaction between OpenSSH and the musl code library, specifically when OpenSSH does not use PAM and certain password hashing configurations are present. Attackers can trigger the vulnerability by entering excessively long passwords for passwordless accounts, leading to unauthenticated access. Security firms like Greynoise have observed "mature intrusions" by a group named GT10, which is deploying a backdoor called TAC Agent that appears to be AI-generated and includes Chinese comments. Exploitation activity has also been reported by watchTowr and Previdian, with connections to botnets and cryptocurrency. OpenSSH has released a fix for the vulnerability, urging users to update promptly.

The active exploitation of the "*sshole" vulnerability highlights a critical security blind spot in specific Linux configurations, particularly those using OpenSSH with musl and lacking PAM. This situation intensifies the ongoing battle between attackers leveraging sophisticated techniques, including AI-generated tools, and the efforts of security researchers and vendors to patch rapidly evolving threats. The discovery and rapid exploitation underscore the need for continuous vigilance and swift patching cycles within the Linux ecosystem.

This event will likely drive increased scrutiny of the musl library's interaction with other core system components and potentially lead to more rigorous testing and auditing of the SSH protocol under diverse configuration scenarios. Organizations heavily reliant on Linux infrastructure, especially those using Alpine Linux or similar distributions, must prioritize patching this vulnerability to mitigate immediate risks of unauthorized access and data breaches. Future security updates may incorporate more robust checks to prevent similar misinterpretations of hashing functions.