Vulnerability that lets hackers SSH into Linux devices is under active exploitation
Summary
Researchers report that attackers are actively exploiting CVE-2026-123158, a flaw involving OpenSSH and the musl library that can allow unauthenticated access to privileged Linux accounts on systems with specific configurations. OpenSSH has released a fix, and security firms have reported attacks involving botnets, cryptocurrency activity, and a group deploying a backdoor.Key Facts
- The vulnerability affects systems running OpenSSH with musl, without PAM, and with certain password and account settings.
- An attack can be triggered by submitting a password longer than 256 characters for a passwordless account.
- The flaw can give attackers unauthenticated access to high-privilege accounts on vulnerable systems.
- Greynoise reported attacks on its Southeast Asian honeypots by a group it tracks as GT10.
- Greynoise said GT10 uses a backdoor called TAC Agent that can run shell commands, gather system information, and maintain access.
- WatchTowr and Previdian also reported exploitation activity; Previdian observed 20 attempts from 13 IP addresses geolocated to nine countries.
- Alpine Linux systems are among those the article identifies as particularly relevant targets.
- OpenSSH has released an update that prevents the attacks from working.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
