Loading story…
Erlang/OTP disclosed CVE-2025-32433 in its SSH implementation as an unauthenticated remote code execution vulnerability, tracked in GitHub advisory GHSA-37cp-fgq5-7wc2. Public descriptions characterize the issue as a pre-authentication flaw tied to improper handling of SSH protocol messages, including malformed SSH_MSG_CHANNEL_REQUEST packets, allowing attackers to execute code on exposed Erlang-based SSH servers without valid credentials. Several repositories also describe the weakness as related to missing authentication for a critical function (CWE-306).
After disclosure, GitHub saw a rapid spread of public exploit material, including proof-of-concept code, remote shell implementations, offensive modules, lab-focused exploit scripts, and later detection tooling. Repositories from multiple authors published exploit variants in Go and other formats, along with testing tools for identifying vulnerable systems, indicating that exploitation knowledge quickly became broadly accessible to both defenders and attackers. The volume and persistence of these repositories suggest that organizations running Erlang/OTP SSH services faced elevated risk of opportunistic scanning and weaponized exploitation soon after the advisory became public.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Further GitHub repositories referencing exploit code for CVE-2025-32433 were published later in 2025 and early 2026, showing sustained interest and continued reposting or adaptation of offensive tooling.
A GitHub repository released detection-focused tooling for CVE-2025-32433, adding defensive capability to identify vulnerable systems or related activity.
A later GitHub repository published an additional proof-of-concept exploit for the unauthenticated Erlang/OTP SSH RCE, reflecting ongoing public circulation of exploit code months after disclosure.
Another GitHub repository released a custom security testing tool for identifying or exploiting the critical pre-authentication Erlang-based SSH vulnerability, expanding publicly available tooling.
A dedicated exploitation module for the Erlang/OTP SSH vulnerability was published on GitHub, showing continued maturation of offensive tooling beyond basic proof-of-concept code.
Within days of disclosure, multiple GitHub repositories published exploit code or attack overviews for CVE-2025-32433, indicating rapid public weaponization and researcher interest. Early examples appeared from April 18 onward.
The Erlang/OTP project published a security advisory for CVE-2025-32433, describing an unauthenticated remote code execution flaw in Erlang/OTP SSH. This marks the public disclosure of the vulnerability by the vendor.
14 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity vulnerability tracked as **CVE-2024-6387** has been disclosed in **OpenSSH `sshd`**, where a race condition in signal handling can let a remote, unauthenticated attacker trigger **remote code execution** or cause a **denial of service** by precisely timing a timeout during authentication. The bug, widely referred to as **regreSSHion**, affects OpenSSH versions **8.5p1 through 9.7p1** and revives a class of weakness in one of the most widely deployed remote administration services on Linux and Unix-like systems. Reports said the exposure could affect roughly **700,000 Linux systems**, underscoring the internet-facing risk for organizations that rely on SSH for remote access. **OpenSSH 9.8 and later** include a fix, and vendors including **Red Hat** have issued advisories for impacted deployments, prompting defenders to identify exposed `sshd` instances, prioritize patching, and review compensating controls for externally reachable SSH services.
Jun 29, 2026
Threat actors are actively exploiting **React2Shell**, a critical remote code execution flaw in React Server Components tracked as `CVE-2025-55182`, with related exposure also noted in Next.js as `CVE-2025-66478`. The bug stems from insecure deserialization in the React Server Components Flight protocol and allows unauthenticated attackers to upload malicious payloads and execute arbitrary code on vulnerable internet-facing servers. Public disclosure was quickly followed by advisories, proof-of-concept code, and reports of broad exploitation, while Microsoft and other researchers said hundreds of machines had already been hacked. Follow-on campaigns have been widespread and largely opportunistic, ranging from credential-harvesting operations to malware deployment against organizations in multiple sectors and regions. Cisco Talos-linked reporting said at least **766 servers** were compromised by an automated campaign that stole SSH keys, cloud tokens, API keys, Kubernetes and GitHub credentials, Docker metadata, and other environment secrets, including keys tied to AI platforms and payment services. Other investigations tied exploitation to **XMRig**, **RustoBot**, **Kaiji**, **Sliver**, **CrossC2**, **Tactical RMM**, **VShell**, and **EtherRAT**, along with persistence, reconnaissance, DNS-based exfiltration, and SSH key installation, underscoring how rapidly the vulnerability was weaponized after disclosure.
Jun 29, 2026
A flaw in OpenSSH's GSSAPI key exchange handling was disclosed on the `oss-security` mailing list and later tracked as **CVE-2026-3497**, with Red Hat describing the issue as an information disclosure or denial-of-service condition caused by uninitialized variables. The bug affects OpenSSH deployments that use GSSAPI authentication or key exchange, where improper handling of internal state can allow an attacker to trigger crashes or expose unintended memory contents under certain conditions. Vendor tracking shows the issue moved from public disclosure into downstream remediation, with Red Hat opening Bugzilla case `2447085` for affected products. Separate references to Oracle Linux and a SonicWall advisory indicate vendors were also assessing or mapping related OpenSSH exposure in their own ecosystems, underscoring that the impact extends beyond a single distribution and requires organizations using GSSAPI-enabled SSH services to review patches and product advisories promptly.
Jul 10, 2026