Loading story…
A pseudonymous researcher publicly released a proof-of-concept exploit for CVE-2026-55200, a pre-authentication remote code execution flaw in libssh2, as part of a larger GitHub dump of more than 30 zero-day exploits affecting open-source software. Reporting on the release said the libssh2 issue was independently verified, assigned a CVSS 9.2, and described as being under active exploitation, intensifying concern because the disclosure bypassed coordinated vulnerability reporting and exposed defenders before maintainers had broadly completed remediation.
Technical advisories identified the bug as an out-of-bounds write caused by an unchecked packet_length value in transport.c, and national CERT guidance later included it among SSH-related product vulnerabilities. The combined disclosures indicate that systems using vulnerable libssh2 builds may be exposed to unauthenticated compromise over SSH-related communications, prompting organizations to urgently inventory affected software, apply vendor fixes as they become available, and monitor for exploitation tied to malformed transport-layer packets.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
A pseudonymous researcher using the names “bikini” and “ashdfrkl” first published the public GitHub repository “Exploitarium” on June 27. The repository initially contained around 15 proof-of-concept exploits for zero-day vulnerabilities affecting multiple open-source projects.
Ethan Andrews of Federal Signal Corporation said CVE-2026-55200 had been independently verified and described it as the most severe vulnerability in the exploit dump. He also said the flaw was under active exploitation.
A fix for CVE-2026-55200 was integrated into the libssh2 mainline development branch. At the time of reporting, a formal libssh2 release containing the patch was still being finalized.
VulnCheck publicly disclosed CVE-2026-55200, a pre-authentication remote code execution flaw in libssh2 involving specially crafted SSH packets with oversized packet_length values. VulnCheck credited Tristan Madani (@TristanInSec) with reporting the issue to them.
After its initial publication, the Exploitarium repository was expanded over the following days to include more than 30 proof-of-concept exploits. The dump bypassed coordinated vulnerability disclosure and prompted public debate.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cert.gov.py
Open sourceinfosecurity-magazine.com
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple vulnerabilities in **libssh2** have exposed SSH clients and products that embed the library to attacks from malicious or impersonated SSH servers. The most severe issue, **`CVE-2026-55200`**, is a pre-authentication out-of-bounds heap write in `ssh2_transport_read()` that affects all versions through **1.11.1** and could allow remote code execution, while **`CVE-2026-55199`** can force clients into a CPU-intensive loop during key exchange and cause denial of service. The library is widely used in **curl**, backup software, IoT firmware, and network appliances, raising broad supply-chain risk, especially where libssh2 is statically linked or bundled into downstream products. A separate flaw, **`CVE-2025-15661`**, affects `sftp_symlink()` in `src/sftp.c` and can be triggered during SFTP `READLINK` or `REALPATH` operations when a malicious server or man-in-the-middle sends a crafted `SSH_FXP_NAME` response with an oversized `link_len` value. That bug causes a heap buffer over-read that may disclose memory contents or crash applications. Fixes were reported in commits **`97acf3d`**, **`1762685`**, and **`2dae302`**, but at the time of reporting no official libssh2 release containing the newer patches had been published, leaving downstream vendors responsible for shipping their own updates.
Jul 12, 2026
A GitHub repository called **"exploitarium"**, operated by the account **`bikini`**, has published a growing archive of uncoordinated zero-day proof-of-concept exploits affecting dozens of open-source and infrastructure projects before vendors could patch them. Reporting says the archive expanded beyond early public estimates to **35 project folders and 204 tracked files**, with new targets continuing to appear at a pace of roughly two to three projects per week. The exposed attack surface spans libraries, kernel drivers, remote-access tools, web applications, and core infrastructure including **PostgreSQL, Redis, Nextcloud, Discourse, Nmap, curl, AnyDesk, RustDesk, Git,** and some **PHP** builds. Researchers identified **`CVE-2026-55200`** in **libssh2** as one of the most serious issues in the archive: a pre-authentication out-of-bounds write in **`ssh2_transport_read()`** affecting libssh2 through **1.11.1**, with an upstream fix referenced as commit **`97acf3d`**. Because libssh2 is embedded transitively in widely used software such as **curl** and **Git**, the disclosures are being treated as a broader supply-chain exposure rather than a single incident. Assessments describe exploitarium as a lightly moderated multi-contributor clearinghouse that distributes unvetted exploit material at scale, prompting calls for urgent patching, software composition analysis, reachability-based remediation, and sustained monitoring.
Jul 22, 2026
Erlang/OTP disclosed **CVE-2025-32433** in its SSH implementation as an **unauthenticated remote code execution** vulnerability, tracked in GitHub advisory `GHSA-37cp-fgq5-7wc2`. Public descriptions characterize the issue as a **pre-authentication** flaw tied to improper handling of SSH protocol messages, including malformed `SSH_MSG_CHANNEL_REQUEST` packets, allowing attackers to execute code on exposed Erlang-based SSH servers without valid credentials. Several repositories also describe the weakness as related to missing authentication for a critical function (`CWE-306`). After disclosure, GitHub saw a rapid spread of public exploit material, including proof-of-concept code, remote shell implementations, offensive modules, lab-focused exploit scripts, and later detection tooling. Repositories from multiple authors published exploit variants in Go and other formats, along with testing tools for identifying vulnerable systems, indicating that exploitation knowledge quickly became broadly accessible to both defenders and attackers. The volume and persistence of these repositories suggest that organizations running Erlang/OTP SSH services faced elevated risk of opportunistic scanning and weaponized exploitation soon after the advisory became public.
Jul 23, 2026