Loading story…
A critical flaw in OpenSSH server, tracked as CVE-2024-6387 and dubbed regreSSHion, can allow an unauthenticated attacker to achieve remote code execution with root privileges under specific conditions. The issue affects OpenSSH versions 8.5p1 through 9.7p1, and public reporting says it has been actively exploited in the wild with proof-of-concept code available. Researchers and national defenders also highlighted related issues, including CVE-2024-6409, a less severe code-execution variant identified during analysis, and CVE-2024-7589, a FreeBSD-specific variant patched separately.
Defenders were urged to upgrade to OpenSSH 9.8p1 or later to remove exposure. Where immediate patching is not possible, guidance recommends temporarily restricting or disabling SSH access, or setting LoginGraceTime to 0 as a mitigation, while warning that this workaround can disrupt service availability and should be treated as temporary until systems are fully updated.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
The references state that administrators should upgrade to OpenSSH 9.8p1 or later to remediate CVE-2024-6387, indicating that version 9.8p1 was released with a fix for the issue.
On August 13, 2024, CSIRT.SK published an alert stating that CVE-2024-6387 was being actively exploited in the wild and that public proof-of-concept code was available.
The CSIRT.SK reference says a FreeBSD-specific variant, CVE-2024-7589, was identified and patched separately by FreeBSD developers.
During analysis of CVE-2024-6387, researchers identified a related but less severe code-execution issue, tracked as CVE-2024-6409.
On July 1, 2024, Qualys publicly disclosed CVE-2024-6387 ("regreSSHion"), describing it as a remote unauthenticated code execution vulnerability affecting OpenSSH servers from 8.5p1 through 9.7p1.
Qualys reported that a regression introduced in October 2020 (OpenSSH 8.5p1) reintroduced a previously fixed signal-handler vulnerability, later tracked as CVE-2024-6387 or "regreSSHion." The flaw can enable unauthenticated remote code execution as root under specific conditions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2024-6387** has been disclosed in **OpenSSH `sshd`**, where a race condition in signal handling can let a remote, unauthenticated attacker trigger **remote code execution** or cause a **denial of service** by precisely timing a timeout during authentication. The bug, widely referred to as **regreSSHion**, affects OpenSSH versions **8.5p1 through 9.7p1** and revives a class of weakness in one of the most widely deployed remote administration services on Linux and Unix-like systems. Reports said the exposure could affect roughly **700,000 Linux systems**, underscoring the internet-facing risk for organizations that rely on SSH for remote access. **OpenSSH 9.8 and later** include a fix, and vendors including **Red Hat** have issued advisories for impacted deployments, prompting defenders to identify exposed `sshd` instances, prioritize patching, and review compensating controls for externally reachable SSH services.
Jun 29, 2026
Authorities warned that **Red Hat OpenShift Container Platform 4** contains two high-severity vulnerabilities that can lead to code execution and node takeover in enterprise container environments. `CVE-2024-45496` in `ose-openshift-controller-manager-container` carries a **CVSS 9.9** rating and can allow arbitrary code execution on an OpenShift node when a user with developer-level access exploits insufficient restrictions on elevated privileges. `CVE-2024-7387` in `openshift4/ose-docker-builder`, rated **CVSS 9.1**, can enable arbitrary command execution on an OpenShift node and may allow privilege escalation and full control of the affected node. At the time of the alert, mitigations were available but vendor patches had not yet been released. A separate alert highlighted the **regreSSHion** flaw in **OpenSSH**, which can give an attacker unrestricted root-level access on vulnerable Linux and FreeBSD-based systems. The issue affects OpenSSH versions from `8.5p1` up to but not including `9.8p1`, as well as versions earlier than `4.4p1`; OpenBSD-based systems were reported as not vulnerable. Successful exploitation has been confirmed on systems using **glibc**, while systems using **musl libc** were reported as not vulnerable, and the attack currently requires repeated attempts over hours or days. A fix is available in **OpenSSH `9.8p1`**, though some distributors have backported the patch, meaning package version numbers alone may not reliably indicate exposure.
Jun 29, 2026
OpenSSH released security updates to address two vulnerabilities tracked as **CVE-2025-26465** and **CVE-2025-26466**, with downstream advisories warning that affected deployments could face both server impersonation and service disruption. According to vendor and researcher disclosures, **CVE-2025-26465** can enable a man-in-the-middle attack when `VerifyHostKeyDNS` is enabled, allowing an attacker to bypass host verification, present a crafted key, impersonate a trusted SSH server, and potentially intercept sessions, access sensitive data, or execute commands. The second issue, **CVE-2025-26466**, is a pre-authentication denial-of-service flaw caused by unbounded memory allocation triggered through `SSH2_MSG_PING` messages, which can exhaust memory and disrupt SSH availability. Guidance from OpenSSH and national CSIRT reporting urges organizations to upgrade to **OpenSSH 9.9p2 or later**, disable `VerifyHostKeyDNS` unless it is strictly required, and harden exposed services with connection controls such as `LoginGraceTime`, `MaxStartups`, and `PerSourcePenalties` to reduce exploitation risk.
Jul 24, 2026