Hackers Actively Exploit Critical Linux SSH Vulnerability to Gain Root Access in Seconds

Security researchers are warning of active exploitation targeting a newly disclosed critical vulnerability in Linux systems that allows unauthenticated attackers to log in to high-privilege accounts within seconds.

The flaw, tracked as CVE-2026-123158 and nicknamed "*sshole," stems from a dangerous interaction between the widely used OpenSSH suite and musl, a lightweight alternative code library to libc. First made public last week, the vulnerability is now being targeted by multiple threat groups globally.

Active Exploitation and AI-Generated Backdoors

Security firm Greynoise reported that honeypots it maintains across Southeast Asia came under attack by a threat group tracked as GT10. Researchers observed "mature intrusions" into their real-time monitoring systems and subsequently gained access to a GT10 server, exposing attack tools and potential victim data.

During these intrusions, GT10 deployed a customized backdoor tracked under the name "TAC Agent." According to Greynoise, the backdoor code contains Chinese-language comments and appears to have been generated with the assistance of AI. The payload supports shell execution, system reconnaissance, and persistence. To ensure execution, attackers are manually installing Python3 on compromised machines if the package is not already present.

Other security organizations have confirmed parallel attack waves:

• watchTowr: Observed exploitation activity linked to botnets and cryptocurrency mining operations.
• Previdian: Reported detecting 20 distinct exploitation attempts originating from 13 unique IP addresses across nine countries.

How CVE-2026-123158 Works

The vulnerability requires a specific set of system conditions to be exploitable:

1. The target system must run OpenSSH compiled alongside the musl standard C library instead of default libc.
2. OpenSSH must operate without Pluggable Authentication Modules (PAM) enabled.
3. The SSH system must contain at least one account using SHA256 or SHA512 password hashing while also configuring passwordless accounts by placing an asterisk (*) in the password field of the /etc/shadow file.

Exploitation occurs when an attacker attempts to log into a passwordless account by submitting an abnormally long password string exceeding 256 characters. When OpenSSH processes the oversized input, musl’s password-hashing function encounters an error and returns *. Because the stored shadow file entry for passwordless accounts is also *, the system incorrectly validates the match. As Red Hat noted, the flaw centers on a "misinterpretation of whether a string is intended to be a password hash."

Affected Distributions and Remediations

The bug poses a substantial risk to lightweight Linux distributions, most notably Alpine Linux, which relies heavily on musl. Millions of Internet-exposed SSH servers can be scanned and identified by malicious actors in seconds.

OpenSSH has released an official update that mitigates the flaw. Administrators running OpenSSH on musl-based Linux environments are strongly urged to apply patches immediately and review their system configurations.