Ethical Hacking News
Hackers are exploiting a recently discovered critical vulnerability that allows them to log in to privileged accounts on many Linux systems, posing a serious threat to Internet security. The vulnerability, tracked under the name *sshole, arises from the interaction between OpenSSH and a code library known as musl, and has been actively exploited by hackers. Users and administrators are urged to install the latest security update and take prompt action to protect their systems from this vulnerability.
The Linux community is facing a critical security threat due to a recently discovered vulnerability in OpenSSH. The vulnerability, tracked under the name "sshole", allows hackers to log in to privileged accounts on many Linux systems. The vulnerability is triggered by passwords with more than 256 characters, which causes an error that misinterprets the password as a hash. The vulnerability poses a serious threat to a large base of machines, particularly those running Alpine, a lightweight distribution of Linux. Security firms have detected mature intrusions into systems, suggesting highly organized and targeted attacks. The vulnerability has been publicly known since last Thursday, and multiple security firms have reported exploitation activity related to botnets and cryptocurrency. OpenSSH has released a fix that prevents attacks from working, and researchers urge users to install the update promptly.
The Linux community is currently facing a serious security threat due to a recently discovered critical vulnerability that allows hackers to log in to privileged accounts on many Linux systems. The vulnerability, tracked under the name *sshole, arises from the interaction between OpenSSH and a code library known as musl. This vulnerability has been actively exploited by hackers, with multiple security firms reporting incidents and providing insights into the attacks.
According to researchers at security firm watchTowr, the vulnerability is triggered when an attacker enters passwords with more than 256 characters for a passwordless account. This step occurs when the OpenSSH server hashes the supplied password and checks it against the hash stored in /etc/shadow. The oversized password produces an error that causes musl's password hashing function to return "*. The attacks exploit the "misinterpretation of whether a string is intended to be a password hash," Red Hat said.
Despite the multiple conditions necessary, CVE-2026-123158 poses a serious threat to a large base of machines, most notably those running Alpine, a lightweight distribution of Linux. The ease of exploitation allows hackers to direct malicious commands to any of the millions of SSH servers exposed to the Internet and identify potentially vulnerable ones in seconds. Anyone using OpenSSH should install the update promptly. Those using musl should investigate further.
Security firm Greynoise said that they have detected "mature intrusions" into systems maintained by the firm in Southeast Asia, which suggests that the attacks are highly organized and targeted. Greynoise also gained access to a GT10 server that revealed potential other victims and some of the tools used in the campaign. The group conducting the attacks, tracked as GT10, appears to be using a backdoor that contains Chinese language comments and is generated with the use of AI.
The vulnerability has been publicly known since last Thursday, and the prediction shows signs of becoming real. Four days later, the prediction has become a reality, with multiple security firms reporting exploitation activity related to botnets and cryptocurrency. Security firm Previdian has also reported similar activity, stating that their sensors have seen 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.
OpenSSH has released a fix that prevents attacks from working, and researchers are urging users to install the update promptly. Those using musl should investigate further to understand the risks and potential mitigation strategies.
In conclusion, the *sshole vulnerability poses a serious threat to Linux security, and its ease of exploitation makes it a high-priority concern for the Linux community. As users and administrators, it is essential to stay informed about the latest security updates and to take prompt action to protect their systems from this vulnerability.
Related Information:
https://www.ethicalhackingnews.com/articles/Vulnerability-That-Lets-Hackers-SSH-into-Linux-Devices-Under-Active-Exploitation-ehn.shtml
https://arstechnica.com/security/2026/11/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under-active-exploitation/
Published: Mon Nov 9 16:33:10 2026 by llama3.2 3B Q4_K_M
