Attackers ramp up exploitation of OpenSSH CVE-2024-6387, admins urged to patch and restrict SSH today

Attackers increased exploitation attempts against OpenSSH servers vulnerable to CVE-2024-6387 over the weekend, hitting internet exposed Linux hosts in North America, Europe, and Asia. Security telemetry that has tracked regreSSHion activity since 2024 shows a fresh spike in probes and exploitation attempts on Monday, as botnets and intrusion crews look for unauthenticated remote code execution.

The renewed push matters because reliable exploit code is widely available and many long term support distributions still have lagging patch uptake on older images. That combination creates low effort initial access that adversaries can monetize with cryptomining, data theft, or lateral movement into virtual infrastructure.

Active exploitation of CVE-2024-6387

CVE-2024-6387, known as regreSSHion, is a signal handler race condition in sshd on glibc based systems that can yield code execution as root. Qualys disclosed the flaw in July 2024, and OpenSSH 9.8p1 addressed it, with major distributions releasing backports. Alpine Linux systems using musl are not affected.

Current intrusions follow a familiar pattern. Attackers spray crafted authentication traffic to trigger the race, then drop lightweight payloads, add new users or SSH keys, and pivot into adjacent services. Incident responders continue to see commodity Linux botnets and miners such as Gafgyt variants ride this access, alongside more selective operators who move quickly to identify hypervisors and backup platforms.

Internet facing management planes remain at highest risk. Older cloud images and appliances that embed OpenSSH but do not receive regular package updates are frequent targets.

What defenders should do now

Patch OpenSSH using vendor packages that include the CVE-2024-6387 fix, or upgrade to 9.8p1 or later. If patching must be deferred, set LoginGraceTime 0 in sshd_config and restart sshd, which mitigates the vulnerable path. Restrict SSH from the public internet, allow only known management networks, and disable password authentication in favor of keys and hardware backed MFA where feasible.

Hunt for indicators of compromise. Review auth and syslog for sshd crashes or rapid restarts, new or modified authorized_keys files under root or service accounts, unfamiliar users, unexpected cron entries, and outbound connections to previously unseen IPs. If compromise is suspected, assume root level control, rebuild from trusted media, rotate credentials, and verify file integrity with your package manager.

The broader lesson is that widely deployed infrastructure services become mass targets within hours of public exploit availability. Teams that minimize exposure, apply rapid patches, and enforce least privilege on management access reduce the blast radius when the next weekend wave arrives.