Critical Linux SSH bug *sshole is already under active attack

Greynoise said Monday that honeypots it runs in Southeast Asia came under attack from a group it tracks as GT10. The intrusions were what the security firm calls mature, meaning the attackers knew what they were doing. Greynoise then got inside a GT10 server, which exposed other potential victims and some of the tools used in the campaign.

The bug drawing the attention is *sshole, a critical vulnerability born from the way OpenSSH interacts with the musl code library. Systems running both packages, and meeting a few other conditions, can be cracked open for unauthenticated access to high-privilege accounts in seconds. It became public knowledge last Thursday, and researchers warned it could lead to widespread compromise of Linux machines. Four days later, that warning is playing out.

The backdoor GT10 is dropping in the attacks carries Chinese language comments and looks like it was generated with AI, according to Greynoise. That detail, combined with the server access, gives researchers a rare window into both the crew's tooling and who else may already be caught up in it.

Ars Technica notes that multiple researchers are now reporting live exploitation of *sshole. For anyone running OpenSSH alongside musl, the window between disclosure and attack has closed fast.