Critical Linux vulnerability being actively exploited by hackers
A critical vulnerability tracked as CVE-2026-123158 and dubbed "*sshole" is facing active exploitation, enabling attackers to gain unauthenticated access to privileged accounts on Linux systems within seconds. The issue stems from an interaction between OpenSSH and the musl code library when operating without Pluggable Authentication Modules (PAM). In configurations containing passwordless accounts marked with an asterisk ("*") in /etc/shadow, supplying a password exceeding 256 characters causes musl's hashing function to error out and return "*", which OpenSSH misreads as a valid hash match.
Distributions such as Alpine Linux are particularly susceptible. Security firm Greynoise reported that honeypots in Southeast Asia detected mature compromises by a group tracked as GT10. The attackers deploy an AI-generated backdoor called TAC Agent containing Chinese-language comments, installing Python3 to maintain persistence and execute commands. Researchers at watchTowr and Previdian have documented concurrent exploitation tied to botnets and cryptocurrency mining, with Previdian recording 20 attempts from 13 distinct IP addresses across nine countries. OpenSSH has issued an update resolving the vulnerability, and administrators are advised to patch promptly.
Continue in the app — vote & join in ➔