Researchers at security firm watchTowr said Friday that they, too, are seeing exploitative activity linked to botnets and cryptocurrencies. Security company Previdian also reported similar activity. He said his company’s sensors witnessed 20 exploitation attempts originating from 13 unique attacker IP addresses geolocated across nine countries.
The vulnerability, identified as CVE-2026-123158, resides in OpenSSH, when running alongside musl, a Linux alternative to the widely used libc code library. Additionally, OpenSSH should not use PAM (Pluggable Authentication Modules), a framework that manages user authentication and account access controls. Additionally, SSH configurations must (1) have at least one account accessible using a password hashed using the SHA256 or SHA512 function and (2) also be configured to use passwordless accounts by specifying a “*” in the password field of the /etc/shadow file. Passwordless setups are standard for some account types.
Exploits are triggered when an attacker enters passwords longer than 256 characters for a passwordless account. This step occurs when the OpenSSH server hashes the provided password and compares it to the hash stored in /etc/shadow. The oversized password produces an error that causes musl’s password hash function to return “*”. The attacks exploit “a misinterpretation of whether a string is intended to be a password hash,” Red Hat said.
Despite the multiple necessary conditions, CVE-2026-123158 poses a serious threat to a large base of machines, including those running Alpine, a lightweight distribution of Linux. The ease of exploitation allows hackers to direct malicious commands to any of the millions of SSH servers exposed to the Internet and identify potentially vulnerable ones within seconds. Anyone using OpenSSH should install the update promptly. Those who use musl should investigate further.
Gn tech
