OpenSSH’s update brings broader post-quantum warnings, a new username restriction, and some thoughts on security reporting in the age of AI.

OpenSSH’s latest update brings broader post-quantum warnings, a new username restriction, and some thoughts on security reporting in the age of AI. The post OpenSSH 10.6 Released With Security Fixes…

Posted by Qualys Security Advisory on Feb 21 Hi Jordy, Woo-hoo, awesome work, thank you very much for sharing it! We are looking into it now (and learning from it). Thanks again! With best regards,

The Qualys Threat Research Unit (TRU) has discovered a Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this…

OpenSSH, the bedrock of secure Linux network access, has a nasty security flaw.

Full system takeovers on the cards, for those with enough patience to pull it off

A pre-auth flaw in OpenSSH's GSSAPI Key Exchange (CVE-2026-3497) exposes Ubuntu and Debian servers to heap corruption and data leaks. Patch now.

Posted by Qualys Security Advisory on Feb 18 Qualys Security Advisory CVE-2025-26465: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client CVE-2025-26466: DoS attack against OpenSSH's client and server ======================================================================== Contents ======================================================================== Summary Background Experiments Results MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client DoS...

A proof-of-concept (PoC) exploit for the critical OpenSSH vulnerability CVE-2024-6387, also known as "regreSSHion," has been released, raising alarms across the cybersecurity community.

The Qualys Threat Research Unit (TRU) has discovered a Remote Unauthenticated Code Execution (RCE) vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this…

Posted by Dmitry Belyavskiy on Feb 24 Dear Alexander, Thank you for your efforts! ... This is relevant, thank you! I'm not sure that the check for the src == NULL should be removed at least for the 1st branch. Unfortunately I came across implementations that caused segfault on passing NULL pointers to sprintf-like functions.

The Qualys Threat Research Unit (TRU) has discovered a remote code execution vulnerability in OpenSSH's forwarded ssh-agent. This vulnerability allows a remote attacker to potentially execute…

CVE-2026-59999 reveals flaws in OpenSSH prior to 10.4, mismanaging DisableForwarding and PermitTunnel settings, compromising security.

Re: MitM attack against OpenSSH's VerifyHostKeyDNS-enabled client On 02/18/2025 11:28 AM CET Qualys Security Advisory via Fulldisclosure wrote: Qualys Security Advisory CVE-2025-26465: MitM attack against OpenSSH's VerifyHostKeyDNS-e ... Read more Published Date: Feb 27, 2025 (4 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article.

CVE-2026-59999 reveals a critical vulnerability in OpenSSH affecting secure tunneling. Organizations must audit configurations to prevent unauthorized access.

Posted by Solar Designer on Feb 21 Hi, Thank you Qualys for the very interesting research, as is usual from you. I didn't go as far as CodeQL, but I also did some semi-manual auditing: grep -A100 '[^a-z_]if.[^=!<>]*=[^=]' *.c | less and then search for goto. I did this against patched OpenSSH source tree installed with "rpmbuild -rp openssh-8.7p1-43.el9.src.rpm" hoping to spot any issues there may be specific to this older base OpenSSH version...