GT10 Exploits *sshole Flaw to Breach Linux Systems, Installing TAC Agent

Q: How does a quirky interaction between OpenSSH and the musl library allow hackers to bypass authentication in seconds?

The bypass works because OpenSSH and musl both use the same character, `*`, for very different meanings, and under one SSH code path OpenSSH mistakes an error for a valid password match. On affected systems, `sshd` is handling password checks itself rather than using PAM. For accounts that are meant to be password-disabled or key-only, the `/etc/shadow` password field is often set to `*`, which normally means no password should ever work. But musl’s `crypt()` function returns `*` as an error value when it is asked to hash an overlong password, typically anything above 256 bytes for the relevant SHA-crypt schemes. That creates the collision. An attacker sends a deliberately oversized SSH password. musl fails and returns `*`. OpenSSH then compares that result against the target account’s stored shadow value, which is also `*`, and treats it as a successful match. In effect, a hashing error is misread as proof of authentication. The flaw only works when several conditions line up: the system uses musl rather than glibc, password authentication is enabled, PAM is disabled, the target account has `*` in its shadow entry, and at least one local account has a real SHA-256 or SHA-512 password hash that lets `sshd` follow this vulnerable path. On some Alpine Linux setups, that can expose privileged accounts in a single connection. OpenSSH has patched the issue in 10.6p2, and Alpine and other affected platforms have released fixes.

2 articles · Updated · Ars Technica · Nov 9

Greynoise said GT10 is actively exploiting the newly disclosed *sshole vulnerability, carrying out “mature intrusions” against Linux honeypots in Southeast Asia within four days of the flaw becoming public.
*sshole stems from the interaction between OpenSSH and musl, letting attackers gain unauthenticated access to privileged accounts on affected Linux systems in seconds.
TAC Agent—the backdoor GT10 deploys—supports shell commands, reconnaissance and persistence, and the group is installing Python3 on compromised machines when needed to run it.
A server Greynoise accessed pointed to possible additional victims and showed tooling that included a backdoor with Chinese-language comments that appears to have been AI-generated.
OpenSSH has released a fix for the bug, which quickly raised fears of broad Linux compromise after its disclosure last Thursday.

Sources

Center100%

Ars Technica1h ago

Linux *sshole Vulnerability Actively Exploited by GT10, Installing TAC Agent

linkedin1h ago

Hackers Exploit SSHole OpenSSH Flaw To Hack Linux Systems

With hackers rapidly weaponizing the sshole flaw, are your lightweight Alpine Linux containers secretly exposing privileged accounts to attackers?

How does a quirky interaction between OpenSSH and the musl library allow hackers to bypass authentication in seconds?

CVE-2026-123158: Anatomy, Exploitation, and Defense of the OpenSSH musl libc Authentication Bypass Impacting Alpine Linux and Cloud Containers

Overview

The CVE-2026-123158 vulnerability in OpenSSH was rapidly disclosed and patched after artificial intelligence agents were observed independently rediscovering such flaws within hours. Public exploit scripts and detection tools quickly removed technical barriers, increasing the urgency for organizations to patch. The flaw allowed attackers to bypass authentication on musl libc-based systems, especially Alpine Linux cloud images, by exploiting a logic error when an overlong password was sent to accounts with a '*' in /etc/shadow. This led to immediate root access via the default 'alpine' account and passwordless privilege escalation. Effective defense required not just patching and restarting services, but also shifting from static indicators to behavioral monitoring and careful log analysis.

...