Nearly 11 million SSH servers vulnerable to new Terrapin attacks

Researchers disclosed the Terrapin attack against SSH, a handshake-sequence-number manipulation that can compromise channel integrity and downgrade authentication when certain encryption modes (e.g., ChaCha20-Poly1305 or CBC with Encrypt-then-MAC) are used. Shadowserver reports ~11 million internet-exposed SSH servers (about 52% of scanned hosts) appear susceptible; exploitation requires an adversary-in-the-middle but gives attackers a large pool of targets and a scanner is available to check susceptibility.