The $0.00 Cost of Access: *sshole Flaw Exposes Linux Systems to Instant Breaches

Unauthenticated attackers are currently gaining privileged access to Linux servers in seconds by exploiting a critical vulnerability named *sshole. The flaw stems from a specific interaction between the OpenSSH package and the musl code library. Systems running both components under certain conditions are vulnerable to immediate compromise.

The vulnerability became public knowledge last Thursday. Within four days, security researchers confirmed active exploitation in the wild. This timeline suggests that automated scanning and attack scripts are already deployed against exposed infrastructure. The speed of the response indicates a high value placed on the access this flaw provides.

Greynoise, a security firm, reported on Monday that its honeypots in Southeast Asia are under attack by a group tracked as GT10. The company described these as mature intrusions rather than opportunistic scans. Greynoise gained access to a GT10 server and identified additional potential victims and tools used in the campaign.

The backdoor installed by GT10 contains Chinese language comments and shows signs of AI generation. The malware, identified as TAC Agent, enables shell commands, system reconnaissance, and persistence on compromised machines. Greynoise noted that GT10 is also installing Python3 on systems that lack it, as the backdoor requires the package to function.

OpenSSH has released a patch that stops the attack vector. Administrators of Linux systems using the affected libraries must apply the fix to close the entry point. The data from Greynoise confirms that the theoretical risk of rapid, widespread compromise has become an operational reality for network defenders.