Critical Linux SSH vulnerability *sshole is under active exploitation

What happened

A critical vulnerability known as *sshole, which became public last Thursday, allows unauthenticated access to high-privilege accounts within seconds on Linux systems that use both OpenSSH and the musl code library. Four days later, the flaw is no longer theoretical: it is being exploited in the wild.

Real attacks on honeypots

Security firm Greynoise said Monday that its honeypots in Southeast Asia came under attack by a group it tracks as GT10. The firm described the activity as "mature intrusions" rather than opportunistic probing.

Greynoise later gained access to a GT10 server, which revealed potential additional victims and some of the tools used in the campaign.

AI traces in the backdoor

A backdoor used in the attacks contains Chinese-language comments and appears to have been generated with the help of AI, an early concrete example of AI-assisted attack tooling.

Who is affected

The flaw applies only to Linux systems that use both OpenSSH and musl and meet certain other requirements. Still, the prevalence of that combination reinforces concerns voiced when the bug became public that it could lead to widespread compromise of Linux machines.

What to do

Administrators should review installations that rely on OpenSSH and musl, apply their distribution's patches without delay, and scan SSH access logs for unusual sessions.