A critical Linux vulnerability nicknamed "*sshole" is now under active exploitation, according to researchers cited by Ars Technica. The flaw, tracked as CVE-2026-123158, arises from how OpenSSH interacts with musl, a lightweight C library used by many Linux distributions. On systems running both components and meeting a few other conditions, an attacker can gain unauthenticated access to high-privilege accounts in a matter of seconds.
The bug became public last Thursday and immediately raised concerns that it could lead to widespread compromise of Linux servers. Four days later, security firm GreyNoise said honeypot systems it runs in Southeast Asia had already come under attack from a group it tracks as GT10, which it described as conducting "mature intrusions" rather than opportunistic scanning. GreyNoise says it subsequently gained access to a server used by the group, which revealed other potential victims and some of the tools involved in the campaign, detailed on the company's live tracking page for the vulnerability.
An AI-written backdoor
Among the tools GreyNoise examined was a backdoor containing comments written in Chinese that researchers say appears to have been generated with the help of an AI coding assistant. If confirmed, it would be one of several recent cases of attackers leaning on generative AI tools to speed up malware development rather than writing exploit code by hand — a trend security researchers have been warning about for much of the past year.
Because the flaw requires both OpenSSH and musl to be present, its real-world blast radius is narrower than some other recent Linux vulnerabilities; musl is common on lightweight and embedded systems, such as those built on Alpine Linux, but less common on mainstream enterprise distributions. Even so, the speed with which GT10 moved from public disclosure to working intrusions — well under a week — is a reminder that the window between a bug becoming known and attackers weaponizing it keeps shrinking.
System administrators running affected configurations are advised to check vendor patch notes and apply updates as soon as they are available, and to treat any unexpected high-privilege SSH logins as a potential sign of compromise rather than a false alarm.
