Security researchers are warning that hackers are actively exploiting a critical vulnerability in Linux systems, granting unauthenticated access to high-privilege accounts. The flaw, tracked as CVE-2026-123158, affects systems running OpenSSH alongside the musl C library, a common combination in lightweight distributions like Alpine Linux.
Active Intrusions by GT10 Group
Multiple security firms have confirmed that the vulnerability is being weaponized in the wild. Greynoise, a network intelligence company, reported on Monday that its honeypots in Southeast Asia were targeted by a threat actor group designated as GT10. The group conducted what Greynoise described as “mature intrusions,” successfully compromising the test systems.
Following the intrusion, Greynoise gained access to a server used by GT10. This access revealed the tools and potential victims involved in the campaign. The backdoor deployed by the attackers contains Chinese language comments and appears to have been generated using artificial intelligence. The malware, tracked as TAC Agent, supports shell commands, system reconnaissance, and persistence mechanisms.
To facilitate the attack, GT10 is installing Python 3 on compromised machines that do not already have it, as the backdoor requires the package to function. Other security firms, including watchTowr and Previdian, have also reported similar exploitation activity linked to botnets and cryptocurrency mining operations.
Technical Requirements for the Exploit
The vulnerability resides in the interaction between OpenSSH and musl. For the exploit to succeed, several specific conditions must be met. The system must not use Pluggable Authentication Modules (PAM) for handling user authentication. Additionally, the SSH configuration must include at least one account accessible via a password hashed with SHA256 or SHA512.
A critical factor is the presence of passwordless accounts, indicated by a “*” in the password field of the /etc/shadow file. This configuration is standard for many service accounts on Linux systems. The exploit is triggered when an attacker submits a password longer than 256 characters for such an account.
When OpenSSH hashes the oversized password and checks it against the stored hash, the oversized input causes an error in musl’s password hashing function. This error causes the function to return “*”, which the system misinterprets as a valid password hash. Red Hat, which analyzed the issue, noted that this represents a misinterpretation of whether a string is intended to be a password hash.
Urgent Patching Required
Despite the specific conditions required, the vulnerability poses a severe threat to millions of SSH servers exposed to the internet. The ease of exploitation allows attackers to identify and compromise vulnerable machines in seconds. OpenSSH has released a fix that prevents the attack from working.
Administrators using OpenSSH are urged to install the update immediately. Those running systems with the musl library should investigate their configurations further to ensure they are not exposed to this risk. The active nature of the attacks underscores the urgency of applying the patch to prevent unauthorized access.
Source: Ars Technica
