Researchers at security firm watchTowr said Friday that they, too, were seeing exploitation activity, which was related to botnets and cryptocurrency. Security firm Previdian has also reported similar activity . It said its company’s sensors have seen 20 exploitation attempts from 13 unique attacker IP addresses geolocated to nine countries.

The vulnerability, tracked as CVE-2026-123158, resides in OpenSSH, when it runs alongside musl, a Linux alternative to the widely used libc code library. Further, OpenSSH must not use PAM (pluggable authentication modules), a framework that handles user authentication and account access checks. Additionally, SSH configurations must (1) have at least one account that’s accessible using a password that is hashed using the SHA256 or SHA512 function and (2) also be set to use passwordless accounts by way of specifying a “*” in the password field in the /etc/shadow file.…