Hackers exploit SSHole OpenSSH flaw to breach Linux systems
Hackers exploit SSHole flaw in OpenSSH to breach Linux systems, steal credentials, and gain persistent access.
Hackers are actively exploiting the 'SSHole' vulnerability (CVE-2026-123158) in OpenSSH, allowing them to bypass authentication on certain musl-based Linux systems. The flaw, disclosed by Ozgun Kultekin, enables attackers to log into accounts with asterisked password hashes, potentially leading to root access. Exploitation attempts began shortly after a proof-of-concept became available, with threat actors observed stealing credentials, establishing persistence, and deploying malware like TAC Agent.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenSSH?
Get an email when a new story names OpenSSH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe SSHole vulnerability (CVE-2026-123158) in OpenSSH allowed attackers to bypass authentication on musl-based Linux systems by exploiting how asterisked password hashes are handled, potentially granting root access without valid credentials. Exploitation began almost immediately after a proof-of-concept was published, underscoring the dangerously short window organizations have between disclosure and active attack. Threat actors leveraged the flaw to steal credentials, establish persistent footholds, and deploy malware such as TAC Agent. This incident illustrates a recurring pattern: widely deployed open-source infrastructure components become high-value targets, and organizations that lack rapid patch deployment processes will consistently fall behind attackers who weaponize public exploits within hours.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-123158
- domain — tac.vpnla[.]org
- malware — TAC Agent