Security researchers are reporting widespread active exploitation of a critical vulnerability in OpenSSH that enables unauthorized access to high-privilege accounts on vulnerable Linux systems. The flaw, publicly disclosed last Thursday and tracked as CVE-2026-123158, has already drawn the attention of multiple threat actors conducting targeted intrusions.
Greynoise Intelligence reported Monday that a hacking group designated GT10 has launched attacks against its honeypot systems in Southeast Asia. Analysis of compromised GT10 infrastructure revealed the attackers are deploying a backdoor tool called TAC Agent, which contains Chinese-language code comments and appears to have been generated using artificial intelligence. The malware supports multiple capabilities including command execution, system information gathering, and persistence mechanisms. The group is also installing Python3 on compromised machines to enable the backdoor’s functionality.
Other security organizations have documented similar exploitation activity. WatchTowr researchers observed attacks related to botnet activity and cryptocurrency operations, while Previdian’s sensors detected 20 exploitation attempts originating from 13 unique IP addresses distributed across nine countries. The vulnerability affects OpenSSH installations running alongside musl, a Linux standard library alternative, when certain configuration conditions are present, including the absence of pluggable authentication modules and specific password hashing configurations.
The exploitation technique involves submitting passwords exceeding 256 characters against passwordless accounts, triggering a hashing error that enables unauthorized access. While the attack requires multiple specific system conditions to succeed, the ease of exploitation poses significant risk to exposed SSH services. Alpine Linux distributions are noted as particularly vulnerable due to their common use of the affected software combination. OpenSSH has released patches addressing the flaw, and vendors including Red Hat have issued guidance recommending immediate installation of updates.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI