A vulnerability in Linux systems running OpenSSH alongside the musl code library is being actively exploited, allowing attackers to gain unauthenticated access to high-privilege accounts within seconds. The flaw, tracked as CVE-2026-123158, became publicly known last Thursday and raised immediate concerns about widespread compromise of Linux machines. Four days later, security firm Greynoise reported that honeypots it maintains in Southeast Asia had come under attack by a group it tracks as GT10.
Greynoise said GT10 carried out what it described as mature intrusions into the systems, which the firm uses to detect attempted or successful attacks in real time. Greynoise subsequently gained access to a GT10 server that revealed potential additional victims and some of the tools used in the campaign. A backdoor the group is using contains Chinese language comments and appears to have been generated with the use of AI. According to Greynoise, GT10 is also installing the Python3 release on machines that lack it, because the package is required to run the backdoor, tracked as TAC Agent, which supports shell commands, system reconnaissance and persistence.
Researchers at security firm watchTowr said Friday that they were also observing exploitation activity tied to botnets and cryptocurrency. Security firm Previdian reported similar activity, saying its sensors had seen 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries. OpenSSH has released a fix that prevents the attacks from working.
The vulnerability resides in OpenSSH when it runs alongside musl, a Linux alternative to the widely used libc code library. OpenSSH must also not use PAM, the pluggable authentication modules framework that handles user authentication and account access checks. In addition, SSH configurations must have at least one account accessible using a password hashed with the SHA256 or SHA512 function, and must be set to use passwordless accounts by specifying a "*" in the password field of the /etc/shadow file, a configuration standard for certain types of accounts.
Exploitation occurs when an attacker enters passwords longer than 256 characters for a passwordless account, a step that takes place when the OpenSSH server hashes the supplied password and checks it against the hash stored in /etc/shadow. The oversized password produces an error that causes musl's password hashing function to return "*", and the attacks exploit what Red Hat described as a misinterpretation of whether a string is intended to be a password hash.
Despite the multiple conditions required, CVE-2026-123158 poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight Linux distribution. The ease of exploitation allows hackers to send malicious commands to any of the millions of SSH servers exposed to the internet and to identify potentially vulnerable ones in seconds. Anyone using OpenSSH should install the update promptly, and those using musl should investigate further.
More cybersecurity news from TechManNews.
