🚨sshole Bug Hits Linux Systems With OpenSSH and musl, Attacks Already Live

Patch OpenSSH today if you run Alpine or musl

Attackers are already exploiting sshole, a critical flaw that lets anyone reach privileged accounts on Linux machines without logging in. The bug sits in the interaction between OpenSSH and musl, the lightweight libc alternative, and it went public last Thursday. Four days later, researchers started seeing live attacks. If you run OpenSSH on glibc distros like Ubuntu or Debian, you're probably fine, since the bug needs musl. But if you run Alpine in containers or on edge boxes, this is your fire drill. Alpine is the default base image for a huge slice of Docker builds, so check what's actually running before you assume you're safe. Greynoise saw a group it tracks as GT10 running mature intrusions against its Southeast Asian honeypots. Its server analysis turned up a backdoor called TAC Agent with Chinese-language comments, apparently AI-generated, that supports shell commands, reconnaissance, and persistence. watchTowr is seeing botnet and crypto-mining activity, and Previdian logged 20 exploit attempts from 13 IPs across nine countries. OpenSSH has already released a fix that blocks the attack.