Loading story…
OpenSSH 10.3 has been released with five security fixes affecting both the ssh client and sshd, led by a shell-injection risk in ssh(1) where attacker-controlled usernames could trigger arbitrary shell command execution in configurations that use %-token expansion such as %u inside Match exec blocks. The release also fixes improper certificate principal matching in authorized_keys, incorrect acceptance behavior around restricted ECDSA algorithms, and a legacy scp(1) issue that could preserve setuid/setgid bits on downloaded files when run as root under specific conditions.
The update changes certificate handling so empty principals sections no longer act as wildcard matches in risky scenarios, adds command-line validation for ProxyJump/-J to reduce shell-injection exposure, and includes a portability fix for a PAM-related username confusion issue introduced in the OpenSSH 10.2p1 stable branch. OpenSSH 10.3 also drops support for peers that do not implement rekeying and adds operational improvements including IANA-assigned SSH agent forwarding codepoints, per-source penalties for invalid usernames, better multiplexing diagnostics, and fixes for PKCS#11 PIN entry, FIDO/WebAuthn certificate signatures, and an sshd crash condition.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
An oss-sec discussion noted that MITRE had apparently assigned five CVE IDs to the vulnerabilities fixed in OpenSSH 10.3: CVE-2026-35414, CVE-2026-35385, CVE-2026-35386, CVE-2026-35387, and CVE-2026-35388. The identifiers covered issues affecting ssh, sshd, and scp that were patched in the 10.3 release.
OpenSSH 10.3 was announced on 2026-04-02 by Damien Miller. The release patched multiple security issues, including an ssh client shell-injection risk via attacker-controlled usernames, several sshd certificate and algorithm-handling flaws, unsafe legacy scp handling of setuid/setgid bits, and a PAM-related username confusion issue in the portable branch.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
10 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourceseclists.org
Open sourcecybersecuritynews.com
Open sourceseclists.org
Open sourcehelpnetsecurity.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSH has released **version 10.4** with eight security fixes affecting both client and server components, including `sftp`, `scp`, `sshd`, `ssh`, `ssh-agent`, and cryptographic verification logic. The update addresses path traversal-style and file redirection issues that could let a malicious server write files outside intended locations, a **pre-authentication denial-of-service** condition in `sshd`, a client-side **use-after-free** bug, and gaps in authentication delay enforcement. The release also replaces the wildcard matcher with an NFA-based implementation to remove exponential worst-case behavior. The release introduces experimental support for a composite post-quantum signature scheme combining **ML-DSA 44** with **Ed25519**, available only when explicitly enabled and configured. OpenSSH also hardened protocol handling by disconnecting peers that send non-KEX messages during post-authentication rekeying and made seccomp sandbox initialization failures fatal on Linux. Maintainers warned that some changes may break existing deployments, including mixed-case output from `sshd -G`, stricter transport-layer behavior, and the new sandbox failure handling.
Jul 12, 2026
OpenSSH released security updates to address two vulnerabilities tracked as **CVE-2025-26465** and **CVE-2025-26466**, with downstream advisories warning that affected deployments could face both server impersonation and service disruption. According to vendor and researcher disclosures, **CVE-2025-26465** can enable a man-in-the-middle attack when `VerifyHostKeyDNS` is enabled, allowing an attacker to bypass host verification, present a crafted key, impersonate a trusted SSH server, and potentially intercept sessions, access sensitive data, or execute commands. The second issue, **CVE-2025-26466**, is a pre-authentication denial-of-service flaw caused by unbounded memory allocation triggered through `SSH2_MSG_PING` messages, which can exhaust memory and disrupt SSH availability. Guidance from OpenSSH and national CSIRT reporting urges organizations to upgrade to **OpenSSH 9.9p2 or later**, disable `VerifyHostKeyDNS` unless it is strictly required, and harden exposed services with connection controls such as `LoginGraceTime`, `MaxStartups`, and `PerSourcePenalties` to reduce exploitation risk.
Jul 24, 2026
Libssh released versions **0.12.1** and **0.11.5** to fix multiple security issues, including **CVE-2026-59851**, an authentication bypass in deployments where `GSSAPIKeyExchange` is enabled on servers. The flaw allows an authenticated client to log in as an arbitrary local user because the `gssapi-keyex` path fails to verify whether the authenticated Kerberos principal is authorized for the requested account. The vulnerability is tracked as **CWE-863** and carries a **CVSS v3.1** score reflecting high impact to confidentiality, integrity, and availability. The **0.12.1** release addresses **11 CVEs**, while **0.11.5** backports fixes for **8 CVEs** affecting the 0.11 branch. In addition to the authentication bypass, the updates remediate a stack buffer overflow, information disclosure bugs, several denial-of-service conditions, a use-after-free issue, and an integrity downgrade flaw, alongside hardening changes such as zero-initializing `ssh_string` objects and validating peer public keys during Diffie-Hellman key exchange. Red Hat reported **RHEL 8** and **RHEL 9** as unaffected by `CVE-2026-59851`, listed **RHEL 10** status as unknown, and marked **Red Hat Hardened Images** as affected for `libssh` and `libssh2` package entries.
Jul 21, 2026