A critical vulnerability known as sshole is under active exploitation, allowing attackers to gain privileged SSH access to Linux systems using OpenSSH and musl libraries. Security firm Greynoise has tracked attacks by group GT10 in Southeast Asia, which uses an AI-generated backdoor called TAC Agent, while OpenSSH has released a fix.
Background
OpenSSH is the most widely used SSH implementation across Linux distributions, while musl is a lightweight C standard library often used in embedded and containerized environments.
- Source
- Ars Technica
- Published
- Nov 10, 2026 at 03:41 AM
- Score
- 8.0 / 10