'RegreSSHion' Bug Threatens Takeover of Millions of Linux Systems

Qualys TRU disclosed CVE-2024-6387 ('RegreSSHion'), an unauthenticated signal-handler race condition in OpenSSH's sshd that can allow remote code execution as root on glibc-based Linux systems; researchers estimate over 14 million Internet-exposed servers may be vulnerable, the flaw was a regression of a 2006 fix, has a CVSS ~8.1, is noisy and requires many attempts to exploit, and Qualys/maintainers published fixes (upgrade to OpenSSH 9.8p1 or apply advisory patches) with mitigation advice such as network controls, segmentation, log monitoring for IoCs, and intrusion detection.