Hackers Start Exploiting OpenSSH Vulnerability to Compromise Linux Systems

Cybersecurity specialists have recorded active exploitation of the vulnerability CVE-2026-123158, known as *sshole. It allows attackers to bypass password verification and gain unauthorized access to accounts with elevated privileges on some Linux systems. The first reports of the issue appeared on November 5, 2026, and a few days later, researchers discovered real attacks.

The vulnerability is related to the interaction between OpenSSH, software for secure remote access, and the musl library used in several Linux distributions. The most notable risk has been identified for certain configurations of Alpine Linux.

Researchers discovered attacks using *sshole

On November 9, the cybersecurity company GreyNoise reported attacks on special research systems located in Southeast Asia. Such systems are used to identify and analyze the actions of attackers.

Researchers linked the activity to a group designated as GT10. During the investigation, specialists discovered the malware TAC Agent, designed for remote command execution, device information gathering, and maintaining access to the system.

Attackers also attempted to install Python 3 on devices where it was absent, as the program uses this runtime environment. In the TAC Agent code, researchers found comments in Chinese and signs of possible artificial intelligence application in its creation. The origin of the group members has not been established.

The company Previdian independently recorded 20 attempts to exploit the vulnerability from 13 unique IP addresses located in 9 countries. Researchers from watchTowr also reported activity related to botnets and cryptocurrency operations.

Which Linux systems are at risk

The vulnerability affects certain configurations of OpenSSH working with the musl library without using the PAM authentication mechanism.

Exploitation requires the simultaneous fulfillment of additional conditions related to password verification settings and system accounts. An error in processing authentication data can lead to the server accepting an incorrect verification result as permission to log in.

Primarily at risk are improperly configured or unpatched systems accessible for remote connection via SSH. However, the use of Linux or OpenSSH alone does not imply the presence of the vulnerability.

OpenSSH developers released a fix on November 5 in version 10.6p2. Updated packages are also available for Alpine Linux, including versions 3.21–3.24.

Administrators of affected systems are advised to install patches and restart the SSH service. If updating is not yet possible, Alpine Linux developers recommend temporarily disabling password login after verifying the functionality of another access method.

The exact number of devices that have been successfully attacked is still unknown. The detected activity confirms the use of the vulnerability by attackers, but does not allow determining the overall scale of Linux system compromise.