OpenSSH

Tmux gained support for floating panes.

LibreSSL clocked up 4.4.0 and OpenSSH went to 10.6. LLVM Clang LLD updated to version 22.1.6 and the LLVM tool chain added Spark 64, Compiler RT, libunwind, libcxx API and libcxx updated to version 22.1.8. finally in addition to this release offers a number of bug fixes as well as numerous improvements in hardware support see the full change log for details of the changes made over this last six month development cycle and the installation guide details how to get the system up and running with a fresh install while those who are already on earlier releases should follow the upgrade guide in most cases using sysupgrade readers are encouraged to celebrate the new release by donating to the project to support future developments of our favorite os it's really good to see the this release there's quite a few bits and pieces there i would like to highlight a couple of articles so uh dlg you know david gwen has uh has pointed out a couple of his highlights uh it's around pppoe so ppoe leveraged if hard mtu for rfc 4638 instead of parent, if MTU interfaces operate at their maximum supported packet size at all times, independent of the software IP stack MTU.

Enforced MTU sealings during PPoE set palms and SIO SIF MTU based on hardware mtu instead of the parent software if mtu this allows ppoe devices to use mtu 1500 without requiring manual mtu manipulation on the physical parent interface update ppoe all to match uh so dlg's take on this is it was a good insight into how uh i think it's mtu and mtr behave with inside openbsd so it was sort of a more of a a discovery phase of how that worked with inside the operating system itself and then his other one was around some work done in uh VIO net, invert IO and invert IO H.

And this is around the ad checksum offload for guests.

Apart from all the other stuff that's coming down the pipeline, LibreSSL 4.2.2 and 4.3.3 have been released, which brings us to

OpenSSH 10.6.

In their usual unassuming fashion, the OpenSSH project has released a new version, release 10.6.

The full 10.6 release notes are below.

And in the article, you can go and check that out yourself.

And that sounds sort of theoretical, but anyone in cyber defense will tell you that those sorts of chain relationships are very, very common and make it easier to chain together a working exploit.

As an example, in OpenSSH, which provides secure remote access to computers, Claude helped identify complicated signature handling code that could be reached before a user authenticated, even when the relevant algorithm was not enabled.

That work led to some patches and changes, right? Shipped in version 10.6 that removed a bunch of the code an unauthenticated client could previously reach.

fundamentally fewer lines of code, fewer parts of the program are surfaced and available for a visitor who has not logged in, which makes the entire experience safer.

Another involved open SSH, where thousands of lines of code related to an experimental signature algorithm could be reached before authentication, even though the algorithm was disabled by default.

Anthrophic disclosed its findings, and OpenSSH changes in versions 10.5 and 10.6 reduce unnecessary exposure.

The practical lesson is simple.

Security isn't just about finding the next bug.

It's seamless.

The academic paper tested Cryptmove against highly trusted enterprise applications like OpenSSH, PuTTY, and WinSCP, and the attack successfully evaded seven major antivirus products and three different EDR systems.

It achieves that evasion because, again, reading memory is a mundane, millions of times a day occurrence on a Windows operating system.

Right.

Fixes for importing WireGuard configurations with multiple subnets.

Updates to various software packages including Apache, Bash, Bind, Curl, OpenSSH, OpenSSL, SQLite, and systemd.

Improvements to IPFire add-ons such as Observium-Agent and Zabbix.

This update is essential for anyone who wants to keep their IPFire system secure, efficient, and up-to-date with the latest features.

Which function?

The RSA key verification in OpenSSH.

So SHT does its handshake, checks the client's signature against an allowed public key, and the check has been replaced with a check that compares against a hard-coded magic key.

Present that key, and you're in.

In the security news this week: BPFdoor, OpenSSH compresses a little too much, AI can find bugs, but who gets to fix them? TP-Link in the courts, Cisco NX-API, Klingstun, LineageOS Android TV and a Raspberry Pi.

Dell's updater has some privilege problems.

SonicWall SSRF and what that really means.

It's just you gotta do all the steps.

Excuse me.

And I think we put a lot of faith in, in SSH and OpenSSH, uh, and that's one of my older stories too.

Um, I don't have a great explanation for it, but there, there were some vulnerabilities.

Uh, there was an academic paper, um, that talked about an attack, and, uh, essentially, it, it, it boil...