Hackers are actively exploiting a critical vulnerability called *sshole that lets them log in to privileged accounts on many Linux systems that use OpenSSH together with the musl library. Greynoise reported that its Southeast Asia honeypots were attacked by a group it tracks as GT10, which performed "mature intrusions" and gave the firm access to a GT10 server revealing other potential victims and tools. The backdoor used by the group contains Chinese language comments and appears to have been generated with AI, indicating a sophisticated and possibly state‑linked threat actor.
The exploitation of *sshole threatens the confidentiality and integrity of Linux‑based infrastructure that underpins cloud services, IoT devices, and enterprise workloads, potentially leading to large‑scale data breaches and service disruptions. Because the vulnerability affects a core component (OpenSSH) and a widely used C library (musl), remediation will require coordinated patching across many vendors and could expose supply‑chain weaknesses.