Loading story…
OpenSSH has released version 10.4 with eight security fixes affecting both client and server components, including sftp, scp, sshd, ssh, ssh-agent, and cryptographic verification logic. The update addresses path traversal-style and file redirection issues that could let a malicious server write files outside intended locations, a pre-authentication denial-of-service condition in sshd, a client-side use-after-free bug, and gaps in authentication delay enforcement. The release also replaces the wildcard matcher with an NFA-based implementation to remove exponential worst-case behavior.
The release introduces experimental support for a composite post-quantum signature scheme combining ML-DSA 44 with Ed25519, available only when explicitly enabled and configured. OpenSSH also hardened protocol handling by disconnecting peers that send non-KEX messages during post-authentication rekeying and made seccomp sandbox initialization failures fatal on Linux. Maintainers warned that some changes may break existing deployments, including mixed-case output from sshd -G, stricter transport-layer behavior, and the new sandbox failure handling.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
OpenSSH released version 10.4 with eight security fixes affecting components including sftp, scp, sshd, ssh, and ssh-agent, addressing issues such as malicious-server file write and traversal problems, a pre-authentication denial of service, and a client-side use-after-free bug. The release also introduced experimental composite post-quantum signatures using ML-DSA 44 with Ed25519 and protocol hardening changes including stricter post-authentication rekey handling and fatal seccomp sandbox initialization failures on Linux.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceseclists.org
Open sourcelinuxsecurity.com
Open sourceopenwall.com
Open sourceopennet.ru
Open sourceopennet.me
Open sourcelists.mindrot.org
Open sourcecdn.openbsd.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OpenSSH 10.3 has been released with **five security fixes** affecting both the `ssh` client and `sshd`, led by a shell-injection risk in `ssh(1)` where attacker-controlled usernames could trigger arbitrary shell command execution in configurations that use `%-token` expansion such as `%u` inside `Match exec` blocks. The release also fixes improper certificate principal matching in `authorized_keys`, incorrect acceptance behavior around restricted **ECDSA** algorithms, and a legacy `scp(1)` issue that could preserve `setuid`/`setgid` bits on downloaded files when run as root under specific conditions. The update changes certificate handling so empty principals sections no longer act as wildcard matches in risky scenarios, adds command-line validation for `ProxyJump`/`-J` to reduce shell-injection exposure, and includes a portability fix for a PAM-related username confusion issue introduced in the OpenSSH 10.2p1 stable branch. OpenSSH 10.3 also drops support for peers that do not implement rekeying and adds operational improvements including IANA-assigned SSH agent forwarding codepoints, per-source penalties for invalid usernames, better multiplexing diagnostics, and fixes for PKCS#11 PIN entry, FIDO/WebAuthn certificate signatures, and an `sshd` crash condition.
Jun 29, 2026
OpenSSH released security updates to address two vulnerabilities tracked as **CVE-2025-26465** and **CVE-2025-26466**, with downstream advisories warning that affected deployments could face both server impersonation and service disruption. According to vendor and researcher disclosures, **CVE-2025-26465** can enable a man-in-the-middle attack when `VerifyHostKeyDNS` is enabled, allowing an attacker to bypass host verification, present a crafted key, impersonate a trusted SSH server, and potentially intercept sessions, access sensitive data, or execute commands. The second issue, **CVE-2025-26466**, is a pre-authentication denial-of-service flaw caused by unbounded memory allocation triggered through `SSH2_MSG_PING` messages, which can exhaust memory and disrupt SSH availability. Guidance from OpenSSH and national CSIRT reporting urges organizations to upgrade to **OpenSSH 9.9p2 or later**, disable `VerifyHostKeyDNS` unless it is strictly required, and harden exposed services with connection controls such as `LoginGraceTime`, `MaxStartups`, and `PerSourcePenalties` to reduce exploitation risk.
Jul 24, 2026
Libssh released versions **0.12.1** and **0.11.5** to fix multiple security issues, including **CVE-2026-59851**, an authentication bypass in deployments where `GSSAPIKeyExchange` is enabled on servers. The flaw allows an authenticated client to log in as an arbitrary local user because the `gssapi-keyex` path fails to verify whether the authenticated Kerberos principal is authorized for the requested account. The vulnerability is tracked as **CWE-863** and carries a **CVSS v3.1** score reflecting high impact to confidentiality, integrity, and availability. The **0.12.1** release addresses **11 CVEs**, while **0.11.5** backports fixes for **8 CVEs** affecting the 0.11 branch. In addition to the authentication bypass, the updates remediate a stack buffer overflow, information disclosure bugs, several denial-of-service conditions, a use-after-free issue, and an integrity downgrade flaw, alongside hardening changes such as zero-initializing `ssh_string` objects and validating peer public keys during Diffie-Hellman key exchange. Red Hat reported **RHEL 8** and **RHEL 9** as unaffected by `CVE-2026-59851`, listed **RHEL 10** status as unknown, and marked **Red Hat Hardened Images** as affected for `libssh` and `libssh2` package entries.
Jul 21, 2026