Critical OpenSSH Flaw Exploited in Active Attacks Against Linux Systems
A vulnerability in OpenSSH interacting with the musl library is being weaponized by attackers to gain unauthorized access to privileged accounts on Linux machines, with multiple security firms documenting real-world exploitation campaigns.
Threat researchers have documented ongoing attacks leveraging a newly disclosed critical flaw that grants unauthenticated access to high-privilege accounts across numerous Linux installations. The vulnerability emerges from how OpenSSH and the musl code library interact, and exploitation can succeed within seconds on susceptible systems. Since the flaw became public last Thursday, evidence of active weaponization has surfaced within days.
Attackers conducting "mature intrusions"
Greynoise, a security research firm, detected a threat actor designated GT10 targeting honeypot infrastructure in Southeast Asia on Monday. The intrusions demonstrated sophisticated tradecraft, prompting Greynoise to gain access to a GT10 server and uncover additional potential targets alongside tools deployed in the campaign. The backdoor employed by the group contains Chinese language comments and shows signs of AI-assisted generation.
According to Greynoise, GT10 is deploying Python3 on compromised machines lacking the package, since the backdoor—tracked as TAC Agent—requires it to function. TAC Agent provides attackers with capabilities spanning shell command execution, system enumeration, and persistence mechanisms. OpenSSH has already released a patch addressing the vulnerability.
Researchers at watchTowr reported Friday that they had identified exploitation activity tied to botnet operations and cryptocurrency theft. Previdian, another security vendor, has documented comparable activity, with its sensors recording 20 exploitation attempts originating from 13 distinct attacker IP addresses distributed across nine countries.
Technical requirements for exploitation
The flaw, designated CVE-2026-123158, manifests when OpenSSH operates in conjunction with musl while PAM (pluggable authentication modules) remains disabled. The vulnerability also requires specific SSH configuration conditions:
- At least one account accessible via password hashed with SHA256 or SHA512
- Passwordless accounts configured by inserting a "*" character in the password field within /etc/shadow
Attackers trigger the vulnerability by submitting passwords exceeding 256 characters against passwordless accounts. When the OpenSSH server hashes the oversized password and compares it to the stored hash in /etc/shadow, the musl password hashing function returns "*" due to the error condition. Red Hat characterized this as a "misinterpretation of whether a string is intended to be a password hash."
Despite the multiple preconditions required, CVE-2026-123158 represents a substantial risk to a wide population of systems, particularly those deploying Alpine, a minimal Linux distribution. The straightforward nature of the exploit permits attackers to rapidly probe millions of publicly accessible SSH servers and identify vulnerable targets. Administrators running OpenSSH should apply available updates without delay, and those utilizing musl should conduct thorough assessments.