Do Son The OpenBSD 8.0 release brings OpenSSH 10.6, kernel mitigations, and immediate day-one errata patches addressing critical IPsec memory corruption.
OpenSSH
OpenSSH 10.4 ships eight security fixes, including a client use-after-free (CVE-2026-60002) plus SFTP and SCP path bugs. Update now.
OpenSSH 10.3 fixes critical gaps, including client-side command execution and scp privilege escalation flaws. Update your remote access stacks immediately.
A pre-auth flaw in OpenSSH's GSSAPI Key Exchange (CVE-2026-3497) exposes Ubuntu and Debian servers to heap corruption and data leaks. Patch now.
Critical OpenSSH flaw (CVE-2023-38408) hits Moxa EDS & RKS switches. CVSS 9.8. Remote attackers can execute code. Contact support for patches now.
SEQRITE exposed SkyCloak, an espionage campaign targeting Russian/Belarusian military personnel. It uses malicious LNK files to deploy OpenSSH over Tor obfs4 bridges for stealthy, persistent remote access.
Cyble exposed a Sandworm-linked espionage campaign targeting Belarusian military UAV personnel. It uses a malicious LNK file to deploy OpenSSH over Tor obfs4 for stealthy, persistent remote access.
OpenSSH (before 10.1) has a flaw (CVE-2025-61984) that allows RCE when ProxyCommand is used. Attackers exploit control characters in usernames to inject commands.
Understand the implications of CVE-2025-26465 & CVE-2025-26466 on OpenSSH. Learn about the risks of machine-in-the-middle and DoS attacks.
Field Effect reveals a cyberattack that used newly discovered SimpleHelp RMM software vulnerabilities to deploy the Sliver backdoor and establish persistence mechanisms.
Learn about a sophisticated malware campaign leveraging SSH over TOR to target the Ukrainian military through a backdoor.
Discover the latest threat from the Diicot threat group. Learn about their sophisticated malware campaign targeting Linux environments.
The FreeBSD Project disclosed a critical vulnerability (CVE-2024-7589) in OpenSSH, the widely-used implementation of the SSH protocol suite
CVE-2024-6409, has been found to expose systems to potential remote code execution (RCE) due to a race condition in signal handling
Cisco has issued a critical security advisory, warning users of a high-severity vulnerability (CVE-2024-6387) codenamed "regreSSHion"
TRU has detailed a CVE-2024-6387 flaw, dubbed 'regreSSHion,' that leaves millions of Linux systems vulnerable to remote code execution
CVE-2023-51385 security vulnerability, with a CVSS score of 9.8, threatened the very core of its secure channel operations.
A team of researchers has uncovered a significant security vulnerability in the cryptographic keys used to safeguard data in SSH connections
CVE-2023-38408 is a RCE vulnerability that lies within the ssh-agent's forwarded feature, particularly in relation to the PKCS#11 providers