OpenSSH Update: Patch Those Decade-Old Security Oopsies Now!
OpenSSH security updates tackle a decade-old MitM flaw and a fresh denial of service issue. Qualys discovered these vulnerabilities, proving even virtual vaults need locksmiths! Upgrade to version 9.9p2 and disable VerifyHostKeyDNS—unless you enjoy living on the edge of digital peril.
Hot Take:
Who knew that in the world of cybersecurity, sometimes your greatest enemy is your own code written over a decade ago! OpenSSH is patching up vulnerabilities like a chef trying to close a restaurant with a health inspector on the way. Better late than never, folks!
Key Points:
- OpenSSH just released updates to fix two vulnerabilities: a MitM (Machine-in-the-Middle) flaw and a denial of service issue.
- The MitM flaw, CVE-2025-26465, has been snoozing in the code since 2014, affecting systems where ‘VerifyHostKeyDNS’ was enabled.
- The denial of service vulnerability, CVE-2025-26466, was introduced in August 2023 and can cause system crashes before authentication.
- OpenSSH version 9.9p2 patches these vulnerabilities, and everyone is advised to update pronto.
- Admins are advised to disable ‘VerifyHostKeyDNS’ and implement manual key verification for added security.
Already a member? Log in here