Vulnerability that lets hackers SSH into Linux devices is under active exploitation
"*sshole" poses a serious threat to Internet security.
Hackers are actively exploiting a critical vulnerability known as *sshole, which allows them to gain privileged access to Linux systems, according to multiple researchers. The flaw stems from the interaction between OpenSSH and the musl code library, affecting Linux devices that utilize both. Once hackers identify vulnerable systems, they can gain unauthenticated access to high-privilege accounts within seconds. *sshole was first disclosed last Thursday, prompting immediate alarm about potential widespread compromise.
Security firm Greynoise confirmed the vulnerability's real-world impact on Monday when its honeypots in Southeast Asia were targeted by a group tracked as GT10. The group carried out "mature intrusions" into the systems being monitored by Greynoise, which it uses to detect attempted or successful attacks in real time. Through its investigation, Greynoise obtained access to a GT10 server, revealing potential additional victims and the tools used in the campaign.
The group's backdoor used in the attacks contains Chinese language comments and appears to have been generated with AI assistance.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
