20 Attacks in 9 Countries: *sshole SSH Flaw Hits Linux Boxes

A critical Linux vulnerability nicknamed *sshole is under active exploitation just four days after it became public, according to three separate security firms cited by Ars Technica. The flaw, tracked as CVE-2026-123158, lets unauthenticated attackers reach high-privilege accounts on affected systems in seconds.

What is the *sshole vulnerability?

The bug sits at the intersection of two pieces of software: OpenSSH, the standard remote-login tool used across most Linux servers, and musl, an alternative to the widely used libc code library. A machine is only exposed if it runs both packages together, does not use PAM (pluggable authentication modules) for account checks, has at least one account with a password hashed using SHA256 or SHA512, and also has passwordless accounts configured with an asterisk in the /etc/shadow file — a setup Ars Technica describes as standard for certain account types. Where those conditions line up, an attacker can log in to a privileged account without ever supplying a valid password.

When did the flaw become public, and how fast did attacks start?

*sshole became publicly known last Thursday, Nov. 5, according to Ars Technica's Nov. 9 report. OpenSSH released a fix the same window that "prevents attacks from working," the outlet reported. By Friday, Nov. 6, researchers at watchTowr said they were already seeing exploitation tied to botnets and cryptocurrency activity. By Monday, Nov. 9 — four days after disclosure — Greynoise said its honeypots in Southeast Asia had been hit by what it called "mature intrusions."

"Mature intrusions" — Greynoise, describing attacks on its Southeast Asia honeypots, Nov. 9, 2026

Who is exploiting it, and what tools are they using?

Greynoise is tracking the group behind the Southeast Asia attacks as GT10. The firm said it gained access to a GT10 server that exposed potential victims and some of the group's tooling. A backdoor used in the campaign, tracked as TAC Agent, contains Chinese-language code comments and appears to have been generated with AI assistance, according to Greynoise. TAC Agent supports shell commands, system reconnaissance, and persistence, and GT10 has been installing the Python3 runtime on target machines that lack it because the backdoor requires Python3 to run. Separately, watchTowr's Friday report tied exploitation activity to botnet building and cryptocurrency operations rather than the GT10 campaign specifically.

What does the attack data show so far?

Security firm Previdian said its sensors logged 20 exploitation attempts from 13 unique attacker IP addresses, geolocated to nine countries, according to the Previdian report cited by Ars Technica. That spread — 13 distinct source IPs across nine countries for just 20 recorded attempts — points to a geographically scattered probing effort rather than a single concentrated source, though Previdian's dataset reflects only its own sensor network and not the full scope of global activity.

By the numbers

• 4 days: time from public disclosure (Nov. 5) to confirmed active-exploitation campaigns reported by Greynoise (Nov. 9)
• 20 attempts / 13 IPs / 9 countries: Previdian's sensor count of exploitation attempts and their geographic spread

How exactly does the exploit work technically?

The attack hinges on a password longer than 256 characters submitted against a passwordless account. When OpenSSH hashes that oversized password to check it against the shadow file, musl's password-hashing function throws an error and returns an asterisk instead of a hash. Ars Technica reports that the resulting "misinterpretation of whether a string is int" — essentially a type-confusion bug — lets the authentication check pass when it should fail, handing the attacker access to the account without any valid credential.

What should administrators watch now?

OpenSSH's fix is available and stops the attack from working, per Ars Technica's reporting, making patching the first line of defense for any system running OpenSSH alongside musl without PAM. Beyond patching, several signals from this week's reporting are worth tracking:

• Whether watchTowr's botnet and cryptocurrency-linked exploitation expands beyond the activity it flagged Friday
• Whether GT10's TAC Agent backdoor or its AI-assisted Chinese-language code shows up in intrusions outside Greynoise's Southeast Asia honeypots
• Whether Previdian's attacker-IP count climbs beyond 13 as more sensors report in
• Unexplained Python3 installations on servers that didn't have the runtime before, a behavior Greynoise linked directly to the GT10 backdoor

None of the three firms cited by Ars Technica has published a victim count beyond honeypot and sensor data, and the scope of real-world compromise outside those monitored systems remains unclear from the available reporting.