bleeping-computer Nov 9, 2026 · Crawled Nov 10, 2026

Hackers exploit SSHole OpenSSH flaw to breach Linux systems

3 IoCs 1 CVEs

AI Summary

Hackers are actively exploiting a critical vulnerability in OpenSSH, dubbed 'SSHole' (CVE-2026-123158), to bypass authentication and gain unauthorized access to Linux systems, particularly those based on musl, such as Alpine Linux. The flaw allows attackers to log in to accounts with a password hash set to '*' by sending an oversized password, which triggers an error in musl's password hashing function that OpenSSH misinterprets as a valid match. Exploitation began shortly after public disclosure and proof-of-concept release, with confirmed attacks involving system reconnaissance, credential theft, persistence via SSH authorized_keys modification, and deployment of the TAC Agent Python-based implant.

AI-extracted · verify before operational use

Extracted Entities 1 found

CVE CVE-2026-123158 →

Indicators of Compromise 3 extracted

Type	Value	Detail
IP	tac[.]vpnla[.]org	Details →
Domain	tac[.]vpnla[.]org	Details →
Filename	TAC Agent	Details →

MITRE ATT&CK TTPs 10 techniques

T1021.004 SSH · Lateral Movement T1055 Process Injection · Defense Evasion T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1078.004 Cloud Accounts · Defense Evasion T1083 File and Directory Discovery · Discovery T1098.004 SSH Authorized Keys · Persistence T1105 Ingress Tool Transfer · Command And Control T1110.001 Password Guessing · Credential Access T1543.002 Systemd Service · Persistence