On this page
OpenSSH 10.6 came out on October 6. Its release notes say bugs found by AI tools are being found again by other researchers, which "suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too", so the team "will, for now, be making more frequent releases to get bugfixes into users' hands more quickly".
A new release reaches few servers directly: 9,649 hosts announced 10.6 between October 9 and 13, three to seven days after it came out. Most run their distribution's build, which gets a fix when the distribution backports it. Ubuntu shipped 10.6's fixes to 22.04, 24.04 and 26.04 on October 14 (USN-8928-1). On October 17, Debian's tracker lists the same flaws as minor issues still open in Debian 12 and 13, the compression side channel from Bäumer and Brinkmann's "Crossing the Streams" among them.
So a server's patch level is its distribution's build, and on Debian and Ubuntu, OpenSSH's banner names it, where Exim's only names a version: OpenSSH_9.6p1 Ubuntu-3ubuntu13.19 is one build of Ubuntu 24.04's package, and each distribution's tracker says which build fixed what.
We counted with SSH IP, which holds every host that completed an SSH handshake on TCP port 22, with the server banner it announced. 16,316,296 IPv4 hosts completed one between October 9 and 13, and 15,061,743 of them (92.3%) announced OpenSSH, ahead of Dropbear with 551,905, Cisco's server with 112,065 and MikroTik's ROSSSH with 85,177. Each row also holds the fingerprint of the host's key, which is how we found 3.9 million hosts sharing their key with another host.
regreSSHion, two years on
Qualys disclosed regreSSHion (CVE-2024-6387) on July 1, 2024: a race in sshd that can let an unauthenticated attacker run code as root on glibc-based Linux, in OpenSSH 8.5p1 up to 9.7p1. Searching Censys and Shodan, it counted over 14 million potentially vulnerable OpenSSH servers on the internet, and about 700,000 vulnerable ones among its own customers' internet-facing hosts.
8,380,925 of the hosts we counted announce a version in that range. Read with the build, most of them have the fix:
Ubuntu and Debian shipped the fix for their supported releases the day it was disclosed (Ubuntu, Debian). These hosts announce a build from before it:
| Release | Hosts | Fixed in | Before the fix |
|---|---|---|---|
| Ubuntu 24.04 | 4,161,760 | 3ubuntu13.3 | 72,332 (1.7%) |
| Ubuntu 22.04 | 2,328,591 | 3ubuntu0.10 | 117,800 (5.1%) |
| Debian 12 | 1,163,297 | deb12u3 | 94,098 (8.1%) |
| Ubuntu 23.10 | 13,156 | 1ubuntu3.6 | 514 (3.9%) |
| All four | 7,666,804 | 284,744 (3.7%) |
The Ubuntu 24.04 ones are all on the build 24.04 shipped with in April 2024. Ubuntu's notes say 24.04 is believed not to be exploitable the way Qualys did it, because of how it starts sshd. Another 20,951 hosts run Ubuntu 22.10 or 23.04, whose 9.0p1 is in the range and whose support ended before the fix. 609,156 announce a version in the range with nothing after it, so their banner carries no patch level, and we count them neither way.
Ubuntu's last security update for 22.04 and 24.04 before October 9 came out on September 3, and five weeks later it was on 78.8% of the 24.04 hosts (3ubuntu13.19) and 72.1% of the 22.04 ones (3ubuntu0.17). Debian 12's newest build, deb12u10 from the May 16 point release, was on 60.2%.
Past the end of support
2,974,010 OpenSSH hosts, 19.7%, announce one of seven releases that no longer get security updates without a subscription:
| Release | Hosts | Public updates ended | On the last public build |
|---|---|---|---|
RHEL 7 family (OpenSSH_7.4) | 1,186,890 | June 30, 2024 (CentOS 7) | not in the banner |
| Ubuntu 20.04 | 764,779 | May 2025 | 72.1% (4ubuntu0.13) |
| Debian 11 | 370,477 | August 31, 2026 | 46.7% (deb11u7) |
| Ubuntu 18.04 | 246,342 | May 2023 | 39.5% (4ubuntu0.7) |
| Debian 10 | 149,841 | June 30, 2024 | 47.2% (deb10u4) |
RHEL 6 family (OpenSSH_5.3) | 148,718 | November 30, 2020 (CentOS 6) | not in the banner |
| Ubuntu 16.04 | 106,963 | April 2021 | 39.7% (4ubuntu2.10) |
| All seven | 2,974,010 |
Older Debian and Ubuntu releases, interim Ubuntu ones included, add 305,616 more.
Subscriptions still patch some of them, and Ubuntu's banners show it. Builds from Ubuntu Pro's Expanded Security Maintenance carry +esm: 8,477 of the 20.04 hosts announce one (1.1%), 3,559 of the 18.04 ones (1.4%) and 1,210 of the 16.04 ones (1.1%). TuxCare's carry +tuxcare, on 4,312 of the 20.04 hosts and 3,898 of the 18.04 ones. Freexian's Extended LTS, which Debian's wiki calls "a commercial offering", has shipped Debian 10 builds past deb10u4, and 1,031 hosts announce one (0.7%). It hasn't shipped a newer Debian 11 OpenSSH than LTS's last, deb11u7 from May 15, so a Debian 11 server under it announces the same build as one without it. The RHEL 7 family's banner never shows the build: CentOS 7, Red Hat Enterprise Linux 7 under Red Hat's paid extended support, and Amazon Linux 2, whose support ended on June 30, 2026, all announce OpenSSH_7.4.
Finding old builds in your own ranges
SSH IP has the banner each host announced, so filtering it to the ranges you own or protect lists the hosts on a Debian or Ubuntu build from before their release's fix, or on a release past the end of its support. The same works for a customer's ranges, or a supplier's. A banner can be changed or hidden, and one load balancer can answer for many servers, so take it as what the host announces and check the machine: the package's changelog lists the CVEs each build fixes.
How we counted
SSH IP's rows cover 90 days, and over that long a server that changes address counts twice, so we counted only the IPv4 hosts that completed a handshake between October 9 and 13. A release is read from the banner: OpenSSH_9.6p1 Ubuntu-3ubuntu13.N is Ubuntu 24.04's build N, and OpenSSH_9.2p1 Debian-2+deb12uN is Debian 12's. A banner with no revision is the release's first build, and one with something after the revision, an +esm or a vendor's rebuild, counts with its release. The RHEL families are their bare banners, which other systems built from the same versions can print too. Fix versions are from Ubuntu's and Debian's CVE pages, and support dates from Ubuntu, Debian and CentOS (7, 6), all read on October 17.
SSH IP is a gzipped CSV download, and its docs list the columns. To license it, see pricing or talk to us.
