A critical vulnerability designated CVE-2026-123158 in OpenSSH systems running alongside musl library code has become the subject of active exploitation campaigns, according to multiple cybersecurity firms monitoring attack activity. The flaw, publicly identified last Thursday, allows unauthenticated attackers to gain access to privileged accounts on affected Linux machines in seconds. Within four days of disclosure, evidence of coordinated exploitation emerged across multiple threat actors and geographic regions.
Greynoise Intelligence reported Monday that honeypot systems it operates in Southeast Asia were targeted by a hacking group designated GT10. The firm characterized the intrusions as mature and sophisticated operations. Following the attacks, Greynoise obtained access to GT10 infrastructure, discovering evidence of additional potential victims and toolsets. The group deployed a backdoor known as TAC Agent that contains Chinese language code comments and shows signs of artificial intelligence generation. Researchers at watchTowr also identified exploitation activity during the same period connected to botnet and cryptocurrency operations, while security vendor Previdian documented 20 exploitation attempts originating from 13 distinct attacker IP addresses across nine countries.
The vulnerability requires specific system configurations to be exploited successfully. The flaw emerges from interactions between OpenSSH and musl, an alternative to the standard libc library, when combined with systems that lack PAM authentication modules and contain both SHA256/SHA512-hashed passwords and passwordless accounts using asterisk notation. Attackers trigger the vulnerability by submitting passwords exceeding 256 characters to passwordless accounts, causing musl’s password hashing function to return an asterisk that matches the stored hash value. This misinterpretation allows unauthorized access.
Despite requiring multiple specific conditions, the vulnerability poses substantial risk due to the extensive deployment of OpenSSH on internet-connected systems and the speed at which vulnerable instances can be identified and compromised. Alpine Linux distributions, which are lightweight and widely deployed, represent a particularly affected category. OpenSSH has released patches addressing the issue, and the vendor OpenSSH and organizations running musl-based systems have advised users to apply updates promptly and review their configurations.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI