OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years

SecurityWeek

April 27, 2026 at 12:29 PM

Overview

A significant vulnerability in OpenSSH has been discovered, allowing attackers to gain full root shell access to affected systems. This flaw, which has been present for 15 years, stems from a coding issue that misinterprets comma characters in certificate principals as list separators. As a result, unauthorized users could exploit this vulnerability to escalate privileges and take control of systems. OpenSSH is widely used for secure remote access, making this a serious concern for organizations relying on it for security. Users and administrators are urged to review their systems and apply any available patches to mitigate this risk.

Key Takeaways

Affected Systems: OpenSSH versions with the flaw, affecting both client and server implementations.
Action Required: Apply patches or updates as they become available from OpenSSH maintainers; review configurations to ensure proper handling of certificate principals.
Timeline: Disclosed on [date]

Original Article Summary

A code reuse issue enabled comma characters in certificate principals to be interpreted as list separators. The post OpenSSH Flaw Allowing Full Root Shell Access Lurked for 15 Years appeared first on SecurityWeek.

Impact

OpenSSH versions with the flaw, affecting both client and server implementations.

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Disclosed on [date]

Remediation

Apply patches or updates as they become available from OpenSSH maintainers; review configurations to ensure proper handling of certificate principals.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Exploit, Vulnerability.

Read Original Article

Related Coverage

Utilities Tech Supplier Itron Discloses Cyber-Attack, Operations Unaffected

Infosecurity Magazine

Itron, a technology supplier for utility companies, has reported a cyber incident but believes that its operations remain unaffected. The company has not provided detailed information about the nature of the attack or whether any sensitive data was compromised. Despite the incident, Itron reassured stakeholders that it does not expect any significant impact on its business. This revelation raises concerns about the cybersecurity measures in place within critical infrastructure sectors, as attacks on utility suppliers can have broader implications for service delivery and public safety. Stakeholders in the utilities sector should remain vigilant and conduct thorough assessments of their cybersecurity protocols.

Apr 27, 2026

Widely Used Browser Extensions Selling User Data

Infosecurity Magazine

Recent findings reveal that numerous browser extensions are selling user data, as disclosed in their privacy policies. These extensions, which are widely used, have been caught sharing sensitive information with third parties, raising significant concerns about user privacy and data security. The issue affects a broad range of users who rely on these extensions for various functionalities, including ad-blocking and productivity enhancements. The implications are serious, as users may unknowingly expose their personal data, browsing habits, and even login credentials. This situation calls for heightened scrutiny from both users and regulatory bodies to ensure that privacy standards are upheld and to protect individuals from potential misuse of their data.

Apr 27, 2026

20-Year-Old Malware Rewrites History of Cyber Sabotage

darkreading

Researchers have discovered a malware framework called 'fast16' that dates back to 2004, making it five years older than the notorious Stuxnet. This malware is believed to have been used in cyber sabotage efforts, potentially setting a precedent for future attacks on critical infrastructure. The implications of this discovery are significant, as it suggests that sophisticated cyber threats have been around longer than previously understood. Fast16’s existence raises concerns about the security of various industrial systems that may still be vulnerable to similar attacks. Understanding its capabilities and origins could help organizations better defend against current and future threats.

Apr 27, 2026

Incomplete Windows Patch Opens Door to Zero-Click Attacks

SecurityWeek

A recently identified vulnerability in Windows has been exploited by APT28, a hacking group linked to Russia, in attacks targeting Ukraine and several EU nations. This flaw allows for zero-click attacks, meaning attackers can compromise systems without any user interaction. The incomplete patch aimed at fixing this vulnerability has raised concerns about its effectiveness, potentially leaving users at risk. The ongoing exploitation of this vulnerability poses a serious threat to sensitive data and national security for affected countries. As this situation evolves, it is crucial for Windows users to stay updated on patches and security advisories.

Apr 27, 2026

Money launderer linked to $230M crypto heist gets 70 months in prison

BleepingComputer

Evan Tangeman, a 22-year-old from Newport Beach, California, has been sentenced to 70 months in prison for his role in laundering funds from a significant cryptocurrency theft worth $230 million. This heist involved various cryptocurrencies, and Tangeman was part of a network that helped obscure the origins of the stolen money. The case highlights the ongoing challenges in tracking illicit cryptocurrency transactions and the legal consequences for those involved in such activities. With the rise of digital currencies, law enforcement is increasingly focused on cracking down on money laundering schemes tied to these assets. The sentence serves as a warning to others who might consider engaging in similar illegal actions.

Apr 27, 2026

Malicious AI Prompt Injection Attacks Increasing, but Sophistication Still Low: Google

SecurityWeek

Google has reported an increase in malicious AI prompt injection attacks, although many of these attempts are not sophisticated and pose little harm. Some of these exploits have been identified as potentially dangerous, indicating that while attackers are becoming more active, their methods remain relatively basic. The findings suggest that users and organizations interacting with AI systems should be aware of the risks associated with prompt injections. As AI technology continues to evolve, the security implications of these attacks could become more significant, making it essential for developers and users alike to stay vigilant and informed about the potential for exploitation.

Apr 27, 2026