Loading story…
OpenSSH released security updates to address two vulnerabilities tracked as CVE-2025-26465 and CVE-2025-26466, with downstream advisories warning that affected deployments could face both server impersonation and service disruption. According to vendor and researcher disclosures, CVE-2025-26465 can enable a man-in-the-middle attack when VerifyHostKeyDNS is enabled, allowing an attacker to bypass host verification, present a crafted key, impersonate a trusted SSH server, and potentially intercept sessions, access sensitive data, or execute commands.
The second issue, CVE-2025-26466, is a pre-authentication denial-of-service flaw caused by unbounded memory allocation triggered through SSH2_MSG_PING messages, which can exhaust memory and disrupt SSH availability. Guidance from OpenSSH and national CSIRT reporting urges organizations to upgrade to OpenSSH 9.9p2 or later, disable VerifyHostKeyDNS unless it is strictly required, and harden exposed services with connection controls such as LoginGraceTime, MaxStartups, and PerSourcePenalties to reduce exploitation risk.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK published an advisory describing the impact of CVE-2025-26465 and CVE-2025-26466 and recommending upgrades to OpenSSH 9.9p2 or later. The notice also advised disabling VerifyHostKeyDNS unless necessary and enforcing connection limits such as LoginGraceTime and MaxStartups.
Qualys reported that CVE-2025-26466 was introduced in OpenSSH 9.5p1 via support for the SSH2_MSG_PING packet, enabling a pre-authentication denial-of-service condition through asymmetric resource consumption and memory exhaustion.
Qualys reported that CVE-2025-26465 was introduced in OpenSSH 6.8p1 when a code change caused the client to accept a server key if the VerifyHostKeyDNS option was enabled, exposing affected clients to machine-in-the-middle attacks.
OpenSSH developers released version 9.9p2 to fix CVE-2025-26465 and CVE-2025-26466. The update addressed the VerifyHostKeyDNS-related host verification issue and the SSH2_MSG_PING memory exhaustion flaw.
Qualys Threat Research Unit discovered CVE-2025-26465 and CVE-2025-26466 in OpenSSH and coordinated disclosure with the OpenSSH developers. The flaws enabled a machine-in-the-middle attack in certain client configurations and a pre-authentication denial-of-service attack against servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical flaw in **OpenSSH server**, tracked as `CVE-2024-6387` and dubbed **regreSSHion**, can allow an unauthenticated attacker to achieve remote code execution with **root** privileges under specific conditions. The issue affects OpenSSH versions **8.5p1 through 9.7p1**, and public reporting says it has been **actively exploited in the wild** with proof-of-concept code available. Researchers and national defenders also highlighted related issues, including `CVE-2024-6409`, a less severe code-execution variant identified during analysis, and `CVE-2024-7589`, a **FreeBSD-specific** variant patched separately. Defenders were urged to **upgrade to OpenSSH 9.8p1 or later** to remove exposure. Where immediate patching is not possible, guidance recommends temporarily restricting or disabling SSH access, or setting `LoginGraceTime` to `0` as a mitigation, while warning that this workaround can disrupt service availability and should be treated as temporary until systems are fully updated.
Jul 24, 2026
OpenSSH 10.3 has been released with **five security fixes** affecting both the `ssh` client and `sshd`, led by a shell-injection risk in `ssh(1)` where attacker-controlled usernames could trigger arbitrary shell command execution in configurations that use `%-token` expansion such as `%u` inside `Match exec` blocks. The release also fixes improper certificate principal matching in `authorized_keys`, incorrect acceptance behavior around restricted **ECDSA** algorithms, and a legacy `scp(1)` issue that could preserve `setuid`/`setgid` bits on downloaded files when run as root under specific conditions. The update changes certificate handling so empty principals sections no longer act as wildcard matches in risky scenarios, adds command-line validation for `ProxyJump`/`-J` to reduce shell-injection exposure, and includes a portability fix for a PAM-related username confusion issue introduced in the OpenSSH 10.2p1 stable branch. OpenSSH 10.3 also drops support for peers that do not implement rekeying and adds operational improvements including IANA-assigned SSH agent forwarding codepoints, per-source penalties for invalid usernames, better multiplexing diagnostics, and fixes for PKCS#11 PIN entry, FIDO/WebAuthn certificate signatures, and an `sshd` crash condition.
Jun 29, 2026
OpenSSH has released **version 10.4** with eight security fixes affecting both client and server components, including `sftp`, `scp`, `sshd`, `ssh`, `ssh-agent`, and cryptographic verification logic. The update addresses path traversal-style and file redirection issues that could let a malicious server write files outside intended locations, a **pre-authentication denial-of-service** condition in `sshd`, a client-side **use-after-free** bug, and gaps in authentication delay enforcement. The release also replaces the wildcard matcher with an NFA-based implementation to remove exponential worst-case behavior. The release introduces experimental support for a composite post-quantum signature scheme combining **ML-DSA 44** with **Ed25519**, available only when explicitly enabled and configured. OpenSSH also hardened protocol handling by disconnecting peers that send non-KEX messages during post-authentication rekeying and made seccomp sandbox initialization failures fatal on Linux. Maintainers warned that some changes may break existing deployments, including mixed-case output from `sshd -G`, stricter transport-layer behavior, and the new sandbox failure handling.
Jul 12, 2026