Tech

Vulnerability that lets hackers SSH into Linux devices is under active exploitation

Read full article at source ↗

Based on a feed excerpt; full article content has not been acquired. Source evidence retrieved 09/11/2026, 19:58:23 UTC.

Briefings

A critical SSH vulnerability named sshole allows unauthenticated access to high-privilege accounts on Linux systems using OpenSSH and musl. Greynoise reported that a group tracking as GT10 conducted mature intrusions into its Southeast Asian honeypots, revealing tools and backdoors containing AI-generated Chinese comments. The vulnerability was publicly known last Thursday, with evidence of active exploitation appearing four days later.

Key points

• The vulnerability sshole exploits the interaction between OpenSSH and the musl code library to grant unauthenticated access to privileged accounts on Linux systems.
• A group tracking as GT10 conducted mature intrusions into Greynoise's Southeast Asian honeypots, revealing AI-generated backdoors with Chinese comments.

Context

This finding is significant as it highlights a specific attack vector targeting Linux infrastructure, with evidence of real-world exploitation by a sophisticated group using AI-assisted tools.

Limitations

Evidence is limited to Greynoise's reports of honeypot attacks and mentions of the vulnerability's public disclosure date; no specific attack timestamps, affected system counts, or confirmed attacker identities are provided.

Generated by Bittrees-hosted qwen35-2b sha256:aaf42c8b7c3c on 09/11/2026, 19:59:28 UTC. Based on publisher-provided feed evidence; may not cover the full original article. Check the source for details.

View archived briefing on IPFS
bafybeid2a363c3wgw3uai3gus2b74vhxr3eu5ylcayee4546bfpah2peay