# Researchers report active attacks exploiting Linux SSH vulnerability

_Published Monday, November 9, 2026 at 3:59 PM EST · Security, Infrastructure · Latest · Tier 1 — Major_

![Researchers report active attacks exploiting Linux SSH vulnerability — Primary](https://cdn.arstechnica.net/wp-content/uploads/2023/07/exploit-vulnerability-security.jpg)

Attackers are actively exploiting a vulnerability called sshole to gain unauthenticated access to privileged accounts on some Linux systems, researchers report. The flaw arises from the interaction between OpenSSH and the musl library and affects systems that meet additional requirements.

Greynoise said Monday that a group it tracks as GT10 compromised its Southeast Asian honeypots. The attackers install a backdoor called TAC Agent, which supports shell commands, system reconnaissance and persistence, adding Python3 when needed to run it. OpenSSH has released a fix that prevents the attacks.

## Sources

- [Ars Technica](https://arstechnica.com/security/2026/11/vulnerability-that-lets-hackers-ssh-into-linux-devices-is-under-active-exploitation/)

---
Canonical: https://techandbusiness.org/newswire/TlCKGIf4BjQwDNRh8sTHZl
Published: 2026-11-09T20:59:33.260Z
Story chronology: 2026-11-09T19:41:34.000Z
Retrieved: 2026-11-09T23:09:59.295Z
Publisher: Tech & Business (techandbusiness.org)