From Ars Technica · · 1m 40s
Linux SSH vulnerability under active attack
Hackers are exploiting a critical flaw in OpenSSH that lets them log into privileged accounts on vulnerable Linux systems within seconds.
In brief
Hackers are exploiting a critical flaw in OpenSSH that lets them log into privileged accounts on vulnerable Linux systems within seconds. A critical OpenSSH vulnerability tracked as CVE-2026-123158 is being actively exploited by multiple hacker groups to gain unauthorized access to Linux systems. Originally reported…
Critical flaw in OpenSSH discovered
A vulnerability called sshole allows hackers to log into privileged accounts on many Linux systems without authentication. It became public last Thursday and quickly sparked concerns about widespread compromise.
How the vulnerability works
The flaw arises from interaction between OpenSSH and musl, a Linux code library. Systems using both packages can be hacked to give unauthenticated access to high-privilege accounts in seconds.
Hackers already exploiting the flaw
Security firm Greynoise reported Monday that a group tracked as GT10 conducted mature intrusions into honeypot systems in Southeast Asia. The group is using a backdoor called TAC Agent with Chinese language comments.
Multiple attack campaigns detected
Researchers at watchTowr reported Friday they were seeing exploitation activity related to botnets and cryptocurrency. Previdian said its sensors detected twenty exploitation attempts from thirteen unique attacker IP addresses across nine countries.
Specific conditions required for attack
CVE-2026-123158 requires OpenSSH without PAM, musl library, and specific password configurations. Attackers exploit it by entering passwords with more than two hundred fifty-six characters for passwordless accounts.
“misinterpretation of whether a string is intended to be a password hash”
Alpine Linux at highest risk
Despite multiple conditions needed, CVE-2026-123158 poses serious threat to millions of machines, especially Alpine, a lightweight Linux distribution. OpenSSH has released a fix. Anyone using it should install the update promptly.
The one thing
A critical OpenSSH vulnerability tracked as CVE-2026-123158 is being actively exploited by multiple hacker groups to gain unauthorized access to Linux systems.
