Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Kevin Beaumont (gossithedog@cyberplace.social)'s status on Wednesday, 19-Feb-2025 18:07:04 JST Kevin Beaumont

   Qualys dropped another two OpenSSH vulns this week - CVE-2025-26465 & CVE-2025-26466

   I don’t think either are bad, you should keep calm and patch as per usual.

   The first one needs a non-default config, and PoC for the second also uses a non-default config. Neither are RCE and I doubt will ever see in the wild exploitation.

   Blog: https://blog.qualys.com/vulnerabilities-threat-research/2025/02/18/qualys-tru-discovers-two-vulnerabilities-in-openssh-cve-2025-26465-cve-2025-26466

   Proof of concept: https://www.qualys.com/2025/02/18/openssh-mitm-dos.txt