Vulnerability that lets hackers SSH into Linux devices is under active exploitation

8 relevance

Critical Linux SSH vulnerability under active exploitation, highly actionable for security.

Security arstechnica.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

As a cloud and platform engineer, this directly impacts your SSH-based infrastructure management, especially if you run Alpine-based containers or minimal Linux images where musl replaces glibc, requiring immediate patching and configuration audit.

Key Takeaways

Patch OpenSSH immediately and audit all SSH configurations for passwordless accounts and PAM usage, particularly on Alpine Linux systems.

Vulnerability that lets hackers SSH into Linux devices is under active exploitation

Summary

Hackers are actively exploiting CVE-2026-123158, a critical vulnerability in OpenSSH when paired with the musl library, allowing unauthenticated SSH access to privileged Linux accounts in seconds. The flaw, dubbed *sshole, requires specific conditions: no PAM, passwordless accounts with '*' in /etc/shadow, and SHA256/512 password hashing. Attackers trigger it by sending passwords over 256 characters, causing musl's hashing function to return '*' and bypass authentication. Greynoise reports group GT10 conducting mature intrusions with AI-generated backdoors, while watchTowr and Previdian confirm botnet and cryptocurrency-related exploitation. Alpine Linux systems are most at risk.

Author

Dan Goodin — Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. A journalist with more than 25 years experience, he has been chronicling the...