regreSSHion: an old OpenSSH bug, re-introduced

Potentially vulnerable OpenSSH servers seen on the internet

14M+Qualys, via Censys and Shodan

How it worked

If a client does not authenticate within LoginGraceTime, sshd's alarm handler fires and calls functions that are not safe to call from a signal handler. Hitting the right moment can corrupt the heap. The race is narrow — which is why exploitation took thousands of attempts.

Why it mattered

OpenSSH has one of the best security records in open source. The bug returned through a refactor, not through carelessness: tests did not encode why the old fix existed.

Our reading

Analysis — Altumptic's interpretation of the sources below.

• Every security fix should come with a test that fails if it is undone.
• Signal handlers are a small, sharp attack surface in C programs.
• Exposure counts matter: hard exploits against millions of hosts still find victims.

What it means for you

1. Keep OpenSSH at 9.8p1 or later, or your distribution's patched build.
2. Do not expose SSH to the whole internet when an allowlist or VPN will do.
3. Rate-limit connection attempts (MaxStartups, network controls).