Attackers Target OpenSSH and musl Vulnerability to Hijack Linux Systems

Threat actors are actively exploiting a newly disclosed critical vulnerability affecting Linux systems running OpenSSH in conjunction with the musl C library, according to reporting from Ars Technica . The weakness allows remote, unauthenticated attackers to log in to high-privilege accounts within seconds.

The flaw, tracked as CVE-2026-123158 and informally dubbed '*sshole,' stems from an unexpected interaction between OpenSSH and musl, an alternative C standard library frequently deployed in lightweight environments such as Alpine Linux. First disclosed publicly late last week, the vulnerability has rapidly transitioned from a theoretical weakness into active exploitation across internet-facing servers.

Telemetry from several cybersecurity monitoring firms confirms multiple ongoing campaigns. Security firm GreyNoise reported that honeypots it operates in Southeast Asia encountered intrusions from an activity cluster tracked as GT10. GreyNoise observed the group conducting mature intrusions and gained access to an attacker server, identifying a backdoor named TAC Agent. The backdoor code contains comments in Chinese, appears to be generated using artificial intelligence, and installs Python 3 on target hosts to facilitate persistence, system reconnaissance, and shell command execution.

Separately, researchers at watchTowr documented exploitation activity connected to cryptocurrency operations and botnets, while security firm Previdian recorded 20 exploitation attempts from 13 distinct IP addresses across nine countries.

Exploiting CVE-2026-123158 requires a specific confluence of system settings. Target hosts must run OpenSSH compiled alongside musl without Pluggable Authentication Modules (PAM). The host's configuration must also include at least one account that uses SHA-256 or SHA-512 password hashing, alongside passwordless system accounts marked with an asterisk ('*') in the standard /etc/shadow file.

During an attack, an adversary submits an authentication request against a passwordless account using a password string exceeding 256 characters. When OpenSSH passes the oversized string to musl's hashing routine, the library encounters an error condition and returns an asterisk. OpenSSH evaluates that returned character against the asterisk stored in /etc/shadow, misinterpreting the error value as a successful hash comparison. As Linux distributor Red Hat described the defect, the issue arises from the 'misinterpretation of whether a string is intended to be a password hash.'

OpenSSH has issued an update that mitigates the flaw. Security teams and systems administrators operating internet-exposed Linux machines, particularly lightweight container deployments running Alpine Linux, are advised to apply the patch promptly and verify their authentication configurations.