Security researchers are reporting active exploitation of a critical Linux vulnerability that can let attackers log in to privileged accounts over SSH in a matter of seconds, adding urgency to a flaw that only became public last Thursday. Tracked as CVE-2026-123158 and nicknamed sshole, the issue stems from an interaction between OpenSSH and the musl C library, and it appears to be affecting systems that meet a specific set of configuration requirements.
Why the OpenSSH flaw is drawing immediate attention
The concern around CVE-2026-123158 is not just that it exists, but that it can be used quickly and at scale against Internet-exposed SSH servers. Security researchers say the bug can allow unauthenticated access to high-privilege accounts on Linux systems that use OpenSSH together with musl and have particular authentication settings in place.
That combination creates what researchers describe as a dangerous opportunity for attackers. Even though the exploit depends on several conditions, the vulnerability is considered serious because many systems expose SSH to the public Internet, making them easy to probe automatically for weaknesses.
OpenSSH has already released a fix that prevents the attack from working. Security teams are urging administrators to install the update promptly and to review whether their environments rely on musl-based distributions or other configurations that could be exposed.
How the vulnerability works
According to the reporting, the flaw lives in OpenSSH when it runs alongside musl, a Linux alternative to the more widely used libc code library. Another requirement is that OpenSSH must not use PAM, or pluggable authentication modules, which are commonly used to handle user authentication and account access checks.
The vulnerable setup also has to meet two password-related conditions:
- At least one account must be accessible using a password hashed with SHA256 or SHA512.
- The system must also be configured to allow passwordless accounts by using a “*” in the password field in
/etc/shadow.
Passwordless configurations are standard for certain kinds of accounts, which is part of what makes the issue troubling despite the narrow technical trigger. Once the vulnerable conditions are present, an attacker can send an oversized password during login attempts against a passwordless account.
The exploit is triggered when the supplied password exceeds 256 characters. At that point, OpenSSH hashes the input and compares it against the stored value in /etc/shadow. The oversized input causes an error that leads musl’s password hashing function to return “*”, which the attack then leverages.
Red Hat described the underlying problem as a “misinterpretation of whether a string is intended to be a password hash.” That detail helps explain why the flaw can result in the authentication logic treating the wrong value as valid under specific circumstances.
Researchers are already seeing real-world attacks
Multiple security firms say they are observing exploitation activity in the wild. Greynoise said Monday that honeypots it maintains in Southeast Asia were attacked by a group it tracks as GT10. The company said the group conducted “mature intrusions,” indicating the activity went beyond simple scanning or basic probing.
Greynoise also said it gained access to a GT10 server, which exposed possible additional victims and some of the tools involved in the campaign. Among those tools is a backdoor called TAC Agent, which supports a wide range of functions, including shell commands, system reconnaissance, and persistence.
The company said the backdoor includes Chinese-language comments and appears to have been generated with the help of AI. Greynoise also reported that GT10 is installing Python 3 on systems that do not already have it, because the package is needed to run TAC Agent.
Other researchers have seen similar activity. WatchTowr said Friday that it was observing exploitation tied to botnets and cryptocurrency. Previdian also reported related attacks and said its sensors detected 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.
What makes this especially risky for Linux administrators
Although the exploit requires a specific configuration, the potential impact is broad because SSH is one of the most common remote administration tools on Linux. If attackers can turn a login attempt into access to a privileged account, they can move from probing to control very quickly.
The issue is also especially relevant for Alpine, the lightweight Linux distribution that relies on musl. The reporting describes that ecosystem as one of the most notable targets because of the combination of OpenSSH and musl usage.
That does not mean only Alpine systems are affected, but it does mean administrators should pay close attention to any deployment that uses musl rather than the more typical glibc-based stack. Systems that expose SSH directly to the Internet are likely to attract automated scans and opportunistic exploitation attempts.
Practical steps administrators should take now
Security researchers and vendors are recommending immediate action. The most important steps are straightforward:
- Apply the OpenSSH update that addresses the flaw.
- Check whether the system uses musl and whether PAM is disabled.
- Review
/etc/shadowand authentication settings for passwordless accounts. - Audit Internet-exposed SSH services for signs of suspicious login attempts.
- Verify whether Python 3 has been unexpectedly installed on servers, especially where it is not normally required.
Because the attacks are already active, patching should be treated as urgent rather than routine maintenance. Systems that fit the vulnerable profile may be exposed to rapid automated exploitation, and the fact that multiple firms are now confirming malicious activity suggests defenders should assume attackers are already testing targets at scale.
Why the flaw moved so quickly from disclosure to exploitation
The timeline is one reason the vulnerability has drawn so much attention. It became publicly known last Thursday, and just four days later researchers were reporting signs that it was being used in the wild. That quick turnaround is consistent with the way attackers often prioritize flaws that can be automated against large numbers of machines.
Greynoise’s description of “mature intrusions” suggests the activity is not just experimental. The presence of a backdoor, persistence mechanisms, and installation of dependencies such as Python 3 indicate a campaign designed to maintain access after the initial compromise.
For defenders, the takeaway is clear: CVE-2026-123158 is not a theoretical risk. Even with prerequisites that narrow the field, the vulnerability is already being used in active campaigns, and exposed Linux systems that meet the conditions could be compromised very quickly.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: November 10, 2026 at 10:32 pm
1 views
