Wednesday sees sustained attempts to exploit OpenSSH CVE-2024-6387 on unpatched Linux hosts

Security teams reported continued high volumes of exploit attempts against OpenSSH servers on Wednesday, July 22, 2026, targeting CVE-2024-6387 on internet facing Linux systems. The flaw, known as RegreSSHion, enables unauthenticated remote code execution on hosts that use glibc and run affected OpenSSH releases, which keeps lagging appliances and legacy images exposed.

Nonprofit observatories including The Shadowserver Foundation and the SANS Internet Storm Center continue to record elevated scanning and probing for this vector midweek, indicating attackers still find viable targets two years after a fix shipped. The persistence underscores the long tail of patching for core network services, especially in embedded and vendor locked platforms.

Technical exposure and attacker behavior

CVE-2024-6387 is a signal handling race in sshd introduced as a regression of a 2006 bug. It affects OpenSSH versions 8.5p1 through 9.7p1 on Linux systems that use glibc. OpenBSD and most non glibc platforms are not affected. Exploitation is pre authentication and does not depend on credential strength or MFA.

Reliable compromise typically requires many connection attempts to win the race condition, which suits automated spray tactics. Operators cycle source infrastructure and blend exploit traffic with routine SSH scanning. Indicators include rapid bursts of short lived SSH handshakes, spikes in sshd child processes and CPU usage, and occasional sshd crashes or core files on vulnerable hosts.

Exposure remains concentrated in appliances, containers, and golden images that froze an affected OpenSSH version, and in distributions that require manual updates on long term support branches. Many general purpose Linux distros delivered backported fixes in 2024, but forks and OEM builds do not always inherit them.

Mitigation and detection

Priority actions are to inventory internet reachable SSH, verify package provenance, and apply a patched OpenSSH release or a vendor backport that addresses CVE-2024-6387, then restart sshd. OpenSSH 9.8p1 and supported distro updates contain the fix. Where patching is delayed, restrict network access to SSH from VPNs or allowlisted addresses, place SSH behind a bastion, and enforce connection rate limiting at the firewall.

Temporary mitigation by setting LoginGraceTime to 0 avoids triggering the vulnerable alarm path, but it can create operational risk because unauthenticated sessions do not time out. Credential controls do not mitigate this bug because exploitation occurs before authentication. Monitor for abnormal sshd terminations, new or modified authorized_keys and cron entries, and unusual spikes in failed connection attempts from single or small sets of IP addresses.

This activity reinforces the need for accurate asset inventories and vendor lifecycle guarantees for embedded platforms. Core internet services with ubiquitous footprints remain high value targets, and the economics of mass scanning continue to reward attackers when patches fail to penetrate appliances and long lived images.