Do Son Attackers infected 333 Tor exit nodes with Ebury malware to hijack SSH logins and steal passwords. See how a researcher exposed them.
ssh
wolfSSH 1.6.0 fixes five wolfSSH vulnerabilities, including critical host key flaw CVE-2026-16516 and Windows login bug CVE-2026-83540.
Researchers publicly disclosed a libssh2 vulnerability, CVE-2026-58050, with PoC code. A malicious SSH server can corrupt a client's heap. Patch now.
A critical libssh2 vulnerability, CVE-2026-55200, lets remote attackers trigger an out-of-bounds write and achieve remote code execution. Patch now.
A critical LPE (CVE-2025-14282) in Dropbear SSH allows users to gain root access via Unix socket forwarding. Impacting embedded Linux, it's fixed in v2025.89.
A Critical (CVSS 9.8) flaw (CVE-2025-59396) in WatchGuard Firebox allows unauthenticated remote root access via SSH on port 4118 using default credentials (admin:readwrite). Patch immediately.
OpenSSH (before 10.1) has a flaw (CVE-2025-61984) that allows RCE when ProxyCommand is used. Attackers exploit control characters in usernames to inject commands.
A critical flaw (CVE-2025-59951) in the Termix Docker image's reverse proxy logic allows unauthenticated attackers to steal sensitive SSH host credentials. Update to v1.7.0 now.
A dangerous Go package, disguised as a fast SSH brute-force tool, is secretly stealing login credentials and sending them to an attacker via a Telegram bot.
Multiple critical flaws (CVE-2025-44954, -44957, -44963, -44955, -6243) in Ruckus vSZ/RND allow unauthenticated RCE, auth bypass via hardcoded SSH keys and JWT.
ASEC uncovers attacks on Linux servers installing legitimate proxy software (TinyProxy, Sing-box) to hijack resources for covert operations, bypassing traditional malware detection.
SUSE disclosed flaws in sslh (CVE-2025-46807, CVE-2025-46806) allowing remote DoS attacks via file descriptor exhaustion and unsafe memory access.
Cisco issues advisories for high-severity flaws (CVSS 8.8, 8.7) in IMC and NDFC, risking privilege escalation and device impersonation. Patch immediately!
AyySSHush is a new stealthy botnet backdooring ASUS routers via SSH keys, abusing legitimate features to persist across firmware updates and targeting residential networks globally.
A stealthy campaign is persistently hacking ASUS routers via undocumented bypasses and CVE-2023-39780, building a backdoor network without malware.
A vulnerability in Jenkins Docker images (CVE-2025-32754, CVE-2025-32755) allows SSH host key reuse, enabling attackers to intercept and modify build processes. Update to jenkins/ssh-agent 6.11.2 to mitigate.
Learn about CVE-2025-30095, a critical vulnerability in VyOS that allows man-in-the-middle attacks through SSH key misuse.
Learn about CVE-2025-27095, a JumpServer vulnerability that exposes Kubernetes clusters to token leakage risks.
Learn about the CVE-2025-22275 vulnerability in iTerm2 and how it could have exposed sensitive user data. Stay informed and protect yourself.
Learn about a sophisticated malware campaign leveraging SSH over TOR to target the Ukrainian military through a backdoor.
Discover the latest threat from the Diicot threat group. Learn about their sophisticated malware campaign targeting Linux environments.
Uncover the vulnerabilities of SSH implementations and learn how to secure your network from potential attacks.