Infrastructure·
Critical OpenSSH‑musl flaw "sshole" under active exploitation
A newly disclosed vulnerability combining OpenSSH and the musl C library lets attackers gain unauthenticated root access on Linux systems; active exploitation has been observed across multiple regions.
Security researchers have confirmed that a critical flaw — dubbed sshole (CVE‑2026‑123158) — is being actively exploited in the wild. The bug arises from an interaction between OpenSSH and the musl libc implementation when PAM is disabled and certain password‑hash configurations exist.
GreyNoise reported mature intrusions from a threat actor tracked as GT10, which deployed a backdoor called TAC Agent capable of shell execution, reconnaissance, and persistence. Additional sightings from watchTowr and Previdian show botnet‑style scanning and cryptocurrency‑mining payloads leveraging the same vector.
Technical conditions for exploitation
- OpenSSH linked against musl instead of glibc
- PAM authentication disabled
- At least one account with a SHA‑256 or SHA‑512 password hash
- Passwordless accounts indicated by a “*” in
/etc/shadow
Why it matters for GPU/AI infrastructure: Many AI training clusters run stripped‑down Linux images that favor musl for its small footprint. If those nodes expose SSH without PAM, they become high‑value targets for attackers seeking GPU compute resources. Prompt patching of OpenSSH and enforcement of PAM or key‑based authentication are essential to protect costly accelerator fleets.
- aigpu
- ai gpu
- ai gpu cloud
- aigpu dubai
- linux security
- ssh vulnerability
- musl
- openssh
By AiGpu Editorial · Editorial rewrite based on public reporting (Ars Technica)
← All articles