Hackers are actively exploiting a critical vulnerability in OpenSSH that grants unauthenticated access to high-privilege Linux accounts. The flaw, designated CVE-2026-123158, emerged from an interaction between OpenSSH and musl, a lightweight alternative to the standard libc library.

Linux systems running OpenSSH with musl and certain configuration requirements are vulnerable to complete account compromise within seconds. The vulnerability became public last Thursday; by Monday, exploitation was confirmed globally.

Greynoise detected attacks on its honeypots in Southeast Asia on Monday, attributed to a group it identifies as GT10. The attackers executed what Greynoise called "mature intrusions" and subsequently moved laterally to GT10's own infrastructure, where security researchers found evidence of additional victims and attack tools.

The backdoor GT10 deployed—called TAC Agent—contains Chinese language comments and appears AI-generated. The malware supports shell command execution, system reconnaissance, and persistence mechanisms. GT10 also installs Python3 on targets if absent, a requirement for running TAC Agent.

WatchTowr researchers observed separate exploitation activity on Friday and linked it to botnets and cryptocurrency operations. Previdian's sensors detected 20 exploitation attempts from 13 attacker IP addresses spanning nine countries.

The vulnerability requires a specific configuration: OpenSSH must run without PAM (Pluggable Authentication Modules), at least one account must use a SHA256 or SHA512 password hash, and the system must have passwordless accounts marked with an asterisk in /etc/shadow—a standard practice for administrative and system accounts.

Attackers trigger the flaw by submitting passwords exceeding 256 characters against passwordless accounts. OpenSSH attempts to hash the oversized input, which causes musl's hashing function to return an asterisk. The server then misinterprets this asterisk as a valid match to the stored asterisk in /etc/shadow, granting access.

OpenSSH has released a patch to prevent exploitation.