Threat actors began exploiting a critical OpenSSH vulnerability within nine hours of its public disclosure. The flaw, identified as CVE-2026-123158, affects Linux systems using the musl C library with Pluggable Authentication Modules disabled. Attackers can gain unauthorized access to accounts without valid passwords by submitting oversized credentials. Security researchers confirmed successful root access on a honeypot system running Alpine Linux. Users are advised to update to OpenSSH 10.6p2 and audit system logs for suspicious login attempts.
Read the full story at thehackernews.com.
Photo: unknown (CC0) via Openverse
