Hey, guess what? There’s a new major security concern named regreSSHion, and it’s freaking out IT people everywhere! If you're running Linux servers or connecting via SSH to log-in, this is one bug you will want to know. When I read about this, my first thought was, oh no… I need to check my servers now!
• The bug allows bad guys to take over a system without an actual login connection.
• Once they are in, they have the ability to run processes as the root user of the system (which essentially means full control of the compromised system).
• It is named regreSSHion because a similar bug was fixed in versions of OpenSSH years ago - and for some reason it has returned in new versions!
Isn't it crazy? A security concern we determined how to fix almost two decades ago has returned in newer versions!
• The threat has a high danger score (CVSS 8.1) because hackers can connect from anywhere.
• Experts are calling it the biggest vulnerability since Log4Shell, which made waves a few years back.
• If your firewall, web, or application runs on a Linux server, you are likely impacted.
And, if I'm being honest, that's why it's scary — it's not like this issue is from some small company. It's "in the stack" of the internet.
The good news? Windows and OpenBSD systems are not implicated.
So, if your servers are running Linux, it's time to verify what version of OpenSSH.
Upgrade to OpenSSH 9.8p1 or later. That’s the fixed version. If you are unable to update at this time:
When I initially found out about this discovery, I spent a few hours updating all the servers I administer. It was a little tedious, yes— but completely worth it to avoid a 3 a.m. hack!
Security isn’t about perfection. It’s about vigilance.
What is regreSSHion?
regreSSHion is a major security bug in OpenSSH, which is the tool used to securely attach to remote computers.• The bug allows bad guys to take over a system without an actual login connection.
• Once they are in, they have the ability to run processes as the root user of the system (which essentially means full control of the compromised system).
• It is named regreSSHion because a similar bug was fixed in versions of OpenSSH years ago - and for some reason it has returned in new versions!
Isn't it crazy? A security concern we determined how to fix almost two decades ago has returned in newer versions!
What's with all the fear?
This is mainly concerning because OpenSSH is on millions of servers globally. Cloud systems to small company networks — it's everywhere.• The threat has a high danger score (CVSS 8.1) because hackers can connect from anywhere.
• Experts are calling it the biggest vulnerability since Log4Shell, which made waves a few years back.
• If your firewall, web, or application runs on a Linux server, you are likely impacted.
And, if I'm being honest, that's why it's scary — it's not like this issue is from some small company. It's "in the stack" of the internet.
What systems are impacted?
If you run OpenSSH versions 8.5p1 to 9.7p1 you might be vulnerable. Some even older versions prior 4.4p1 could also be vulnerable if they've missed fixes from earlier back to versions like 7.xThe good news? Windows and OpenBSD systems are not implicated.
So, if your servers are running Linux, it's time to verify what version of OpenSSH.
How to protect your systems
So here’s what you need to do now:Upgrade to OpenSSH 9.8p1 or later. That’s the fixed version. If you are unable to update at this time:
- Limit access to only trusted IPs.
- Disable root logins via SSH.
- Monitor logs for failed access attempts and restarts.
When I initially found out about this discovery, I spent a few hours updating all the servers I administer. It was a little tedious, yes— but completely worth it to avoid a 3 a.m. hack!
Why this matters
This regreSSHion deal underscores that even trusted tools can have dangerous bugs. Ever have the thought, “My system is fine, it has been working for years”? Well, here’s a reason why we need to be vigilant and keep our tools updated, even our “stable” and “safe” tools.Security isn’t about perfection. It’s about vigilance.
