23 Daily — According to arstechnica.com, a recently discovered critical Linux SSH vulnerability named "*sshole" allows hackers to remotely access privileged accounts on many Linux systems and is being actively exploited. The flaw stems from the interaction between OpenSSH and the musl library, permitting unauthenticated attackers to gain high-privilege access within seconds on systems meeting specific conditions. Publicly revealed on November 5, 2026, the threat has rapidly materialized, raising significant internet security concerns.
Hacker group GT10 conducts real-world attacks exploiting the flaw
Security firm Greynoise reported that its honeypots in Southeast Asia have been targeted by a hacker group labeled GT10. This group performed mature intrusion campaigns, and Greynoise gained access to a GT10 server, uncovering potential victims and tools used in the operation. The backdoor employed in these attacks contains Chinese language comments and appears AI-generated.
GT10 installs Python3 on compromised machines, a prerequisite for running their backdoor named TAC Agent. TAC Agent supports features such as shell commands, system reconnaissance, and persistence. OpenSSH has since released a patch to prevent exploitation through this vulnerability.
Despite stringent conditions, the vulnerability affects numerous systems
Researchers at watchTowr and security company Previdian have also observed exploitation activity linked to botnets and cryptocurrency mining. Previdian detected 20 attack attempts from 13 unique IP addresses across nine countries.
Tracked as CVE-2026-123158, the vulnerability exists when OpenSSH runs alongside musl (a libc alternative) without using PAM (pluggable authentication modules). Moreover, the SSH configuration must have (1) at least one account using SHA-256 or SHA-512 hashed passwords, and (2) at least one passwordless account indicated by a "*" in the /etc/shadow password field. The exploit is triggered when attackers submit passwords exceeding 256 characters for a passwordless account, causing musl's password hashing function to return "*" due to an error, which leads to misinterpretation of password hash validity, granting unauthorized access.
This poses a notable threat to lightweight Linux distributions like Alpine Linux, where musl is commonly used. Millions of SSH servers exposed online allow attackers to quickly identify vulnerable hosts within seconds.
Editor's take: Rising Linux security risks demand prompt open source patching
Linux systems are known for stability and security, but the *sshole vulnerability highlights how interactions among core components can reveal new attack vectors, especially impacting musl-based lightweight distributions. Since OpenSSH is extensively used worldwide for remote access, this vulnerability is a major security risk affecting cloud services and enterprise networks alike.
Entrepreneurs must prioritize security by promptly updating critical infrastructure software and monitoring for threats. Assessing whether systems simultaneously use musl and OpenSSH without PAM is a fundamental risk evaluation step. Post-update, employing security scanning and continuous monitoring for abnormal login behaviors is necessary to prevent security incidents from escalating.