The libssh2 software used in several Linux distributions has a security hole that could let an attacker run malicious code on your server.

Description When an SFTP operation fails, sftp_libssh2_error_to_CURLE() translates the resulting SFTP status into a curl error code. The mapper explicitly handled LIBSSH2_FX_OK by returning CURLE_O...

The June 24, 2026, SANS Internet Storm Center Stormcast covered two major security issues: compromised SonicWall firewalls and critical vulnerabilities in widely used libraries. Manuel analyzed SonicWall firewalls patched for 2024 credential-theft vulnerabilities, finding 86% failed to reconcile credentials with Active Directory and 80% did not rotate passwords, leaving legacy or attacker-created accounts active. Additionally, 36% did not terminate stale VPN sessions, and 43% neglected post-patch log reviews for indicators of compromise. The episode also highlighted a heap-based buffer overflow in libssh2 (CVE likely), enabling remote code execution via malicious SSH servers or man-in-the-middle attacks pre-authentication, with patches available. Another critical flaw affected FFmpeg, involving a heap out-of-bounds write in the MagicYUV decoder, risking remote code execution in any software using the library, including video players and serverside conversion tools. The host noted most users rely on precompiled FFmpeg packages with vulnerable decoders enabled by default. The podcast concluded with a travel-related hiatus, resuming the following Monday.

The LumiFTP Amiga client adds FTP, FTPS and SFTP to AmigaOS 3.x with a MUI two-pane layout, transfer queue, and full ARexx scripting.

Avoid busy loop in SSH state machines (both libssh and libssh2) when Curl_timeleft_ms() returns 0 (i.e. no timeout).

Security updates have been issued by **Debian** (network-manager-l2tp and urwid), **Fedora** (perl-Dancer2, perl-Data-Entropy, perl-DBI, perl-Protocol-HTTP2, podman-tui, rust-lru, and rust-lru0.16), **Mageia** (bzip2, cups-filters, libcupsfilters, libssh2, perl-Authen-SASL, perl-HTML-FormFu, tar, unzip, and zip), **Red Hat** (grafana and image-builder), **SUSE** (389-ds, acl, attr, apache2-mod_auth_openidc, apr-util, aws-nitro-enclaves-cli, bzip2, c-ares, clamav, cpio, curl, dhcpcd, dovecot23, dovecot24, dracut, emacs, fuse-overlayfs, go1.25-openssl, go1.26-openssl, google-cloud-sap-agent, google-osconfig-agent, govulncheck-vulndb, gstreamer-devtools, gzip, helm, java-17-openjdk, java-21-openjdk, java-25-openjdk, jq, libBasicUsageEnvironment2, libgpg-error, libidn, librest, libusb-1_0, libvirt, LibVNCServer, libzypp, zypper, lkl, mcphost, MozillaFirefox, mozilla-nspr, mozilla-nss, rust-cbindgen, MozillaFirefox, mozilla-nss, mozilla-nspr, rust-cbindgen, MozillaFirefox, MozillaFirefox-branding-SLE, mozilla-nspr, mozilla-nss, rust-cbindgen, msgpack-c, multipath-tools, NetworkManager, openexr, openssl-3, perl-Protocol-HTTP2, perl-URI, php-composer2, postgresql14, postgresql15, postgresql16, postgresql17, postgresql18, python-aiohttp, python-cryptography, python-h2, python-ruff, python-sqlparse, python311, python312, python39.SUSE_SLE-15-SP3_Update, rav1e, rpcbind, sssd, systemd, tomcat, tomcat11, ucode-intel, udisks2, vim, and wicked2nm), and **Ubuntu** (cgit, dracut, freeciv, konsole, libinput, linux-azure, linux-nvidia-7.0, nginx, vips, and yelp).

libssh2 is a client-side C library that implements the SSH2 protocol for secure remote access, file transfer, and tunneling. FIPS 140-3 support is available

Security updates have been issued by AlmaLinux (buildah, freerdp, gegl04, go-fdo-client, grafana, grafana-pcp, kernel, and pipewire), Debian (aom, chromium, libde265, libssh2, thunderbird, and…

Security updates have been issued by **AlmaLinux** (buildah, freerdp, gegl04, go-fdo-client, grafana, grafana-pcp, kernel, and pipewire), **Debian** (aom, chromium, libde265, libssh2, thunderbird, and tryton-server), **Fedora** (chromium, composer, cosmic-greeter, gegl04, greetd, ibus-table, jss, libheif, lightdm, lxdm, memcached, perl-DBD-Pg, plasma-login-manager, rust-webbrowser, sddm, selinux-policy, slitherer, and tkimg), **Mageia** (expat, mingw-expat, mbedtls, microcode, python-linkify-it-py, and tomcat), **Oracle** (buildah, container-tools:ol8, dbus-broker, freerdp, go-toolset:ol8, grafana-pcp, kernel, kernel-uek, nodejs24, php, and pipewire), **Slackware** (libpcap, libxml2, mozilla-firefox, mozilla-thunderbird, and util-linux), **SUSE** (bson-devel, busybox, bzip2, c-ares, cpio, cups-filters, dracut, ffmpeg-7, ffmpeg-8, file-roller, firefox, firefox-esr, glances-common, grafana, hauler, helm, helm3, java-17-openjdk, java-21-openjdk, lcms2, libcupsfilters, libheif, libmsgpack-c2, libsoup, libsoup2, libusb-1_0, libvirt, LibVNCServer, mcphost, ollama, opencode, openssl-1_1, openssl-3, php-composer2, podman, postgresql15, postgresql17, postgresql18, python, python-aiohttp, python-h2, python-sqlparse, python310, rpcbind, sssd, thunderbird, trivy, ucode-intel, and webkit2gtk3), and **Ubuntu** (linux, linux-aws, linux-aws-7.0, linux-gcp, linux-gke, linux-hwe-7.0, linux-realtime, linux, linux-aws, linux-fips, linux-kvm, linux-lts-xenial, linux, linux-fips, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-raspi, linux-realtime, linux-realtime-6.8, linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-ibm, linux-ibm-5.15, linux-intel-iot-realtime, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-nvidia, linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-realtime, linux-aws-5.4, linux-gcp, linux-gcp-5.4, linux-gcp-7.0, linux-oem-7.0, minetest, and miniupnpd).

It was discovered that libssh2 incorrectly handled certain SFTP server responses. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66032) It was discovered that libssh2 incorrectly handled AES-GCM cipher negotiation. A remote attacker controlling an SSH server could possibly use this issue to cause libssh2 to crash, resulting in a denial of service. (CVE-2026-66033) It was discovered that libssh2 incorrectly handled Encrypt-then-MAC cipher negotiation. A remote attacker controlling an SSH server could use this issue to cause libssh2 to crash or possibly execute arbitrary code. (CVE-2026-66035)

What's Changed ✨ Features Bring the gitoxide aka gix related changes to latest main (#1460) Support value/label choices for placeholders (#1747) Log submodule url + sha and embed url in error ...

Add a new ssh:// scheme that opens a channel over an existing SSH connection and executes a remote command, implemented for both the libssh and libssh2 backends. The command comes from CURLOPT_CUST...

Pseudonymous researcher 'bikini' dumped over 30 zero-day PoC exploits on GitHub on June 27, 2026, without any vendor coordination. CVE-2026-55200 in libssh2 — a pre-auth RCE rated CVSS 9.2 — is already under active exploitation, per independent verification by detection engineer Ethan Andrews. The r