{
  "id": 19207823,
  "title": "Vulnerability that lets hackers SSH into Linux devices is under active exploitation",
  "url": "https://urgent.news/2026/11/09/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T19:41:34.000Z",
  "source": {
    "name": "Ars Technica",
    "slug": "ars-technica",
    "url": "https://arstechnica.com/security/2026/11/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under-active-exploitation/"
  },
  "original_language": "en",
  "account": "Hackers are actively exploiting a critical vulnerability known as *sshole, which allows them to gain privileged access to Linux systems, according to multiple researchers. The flaw stems from the interaction between OpenSSH and the musl code library, affecting Linux devices that utilize both. Once hackers identify vulnerable systems, they can gain unauthenticated access to high-privilege accounts within seconds. *sshole was first disclosed last Thursday, prompting immediate alarm about potential widespread compromise.\n\nSecurity firm Greynoise confirmed the vulnerability's real-world impact on Monday when its honeypots in Southeast Asia were targeted by a group tracked as GT10. The group carried out \"mature intrusions\" into the systems being monitored by Greynoise, which it uses to detect attempted or successful attacks in real time. Through its investigation, Greynoise obtained access to a GT10 server, revealing potential additional victims and the tools used in the campaign. The group's backdoor used in the attacks contains Chinese language comments and appears to have been generated with AI assistance.",
  "summary": "\"*sshole\" poses a serious threat to Internet security.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}