# OpenSSH in 2026: 284,744 servers still before regreSSHion's fix

On Debian and Ubuntu, OpenSSH's banner names the build: 284,744 servers announce one from before regreSSHion's fix, and 2.97 million a release past support.

OpenSSH 10.6 came out on October 6. Its [release notes](https://www.openssh.org/releasenotes.html#10.6) say bugs found by AI tools are being found again by other researchers, which "suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too", so the team "will, for now, be making more frequent releases to get bugfixes into users' hands more quickly".

A new release reaches few servers directly: 9,649 hosts announced 10.6 between October 9 and 13, three to seven days after it came out. Most run their distribution's build, which gets a fix when the distribution backports it. Ubuntu shipped 10.6's fixes to 22.04, 24.04 and 26.04 on October 14 ([USN-8928-1](https://ubuntu.com/security/notices/USN-8928-1)). On October 17, Debian's tracker lists the same flaws as minor issues still open in Debian 12 and 13, [the compression side channel](https://security-tracker.debian.org/tracker/CVE-2026-106582) from Bäumer and Brinkmann's ["Crossing the Streams"](https://arxiv.org/abs/2609.07709) among them.

So a server's patch level is its distribution's build, and on Debian and Ubuntu, OpenSSH's banner names it, where [Exim's](https://internetdata.io/blog/exim-4-100-1) only names a version: `OpenSSH_9.6p1 Ubuntu-3ubuntu13.19` is one build of Ubuntu 24.04's package, and each distribution's tracker says which build fixed what.

We counted with [SSH IP](https://internetdata.io/databases/ssh-ip), which holds every host that completed an SSH handshake on TCP port 22, with the server banner it announced. 16,316,296 IPv4 hosts completed one between October 9 and 13, and 15,061,743 of them (92.3%) announced OpenSSH, ahead of Dropbear with 551,905, Cisco's server with 112,065 and MikroTik's ROSSSH with 85,177. Each row also holds the fingerprint of the host's key, which is how we found [3.9 million hosts sharing their key](https://internetdata.io/blog/duplicate-ssh-host-keys) with another host.

## regreSSHion, two years on

Qualys disclosed regreSSHion (CVE-2024-6387) on July 1, 2024: a race in sshd that can let an unauthenticated attacker run code as root on glibc-based Linux, in OpenSSH 8.5p1 up to 9.7p1. Searching Censys and Shodan, it counted [over 14 million](https://web.archive.org/web/20241226171105/https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server) potentially vulnerable OpenSSH servers on the internet, and about 700,000 vulnerable ones among its own customers' internet-facing hosts.

8,380,925 of the hosts we counted announce a version in that range. Read with the build, most of them have the fix:

![Bar chart of the 8,380,925 IPv4 hosts announcing OpenSSH 8.5p1 to 9.7p1 on port 22, October 9 to 13, 2026: 88.1% on a Debian or Ubuntu build with the regreSSHion fix, 7.3% with no patch level in the banner, and 284,744 (3.4%) on a build from before it.](/blog/media/openssh-version-statistics-regresshion-range.2x.png)

Ubuntu and Debian shipped the fix for their supported releases the day it was disclosed ([Ubuntu](https://ubuntu.com/security/CVE-2024-6387), [Debian](https://security-tracker.debian.org/tracker/CVE-2024-6387)). These hosts announce a build from before it:

| Release | Hosts | Fixed in | Before the fix |
|---|---|---|---|
| Ubuntu 24.04 | 4,161,760 | `3ubuntu13.3` | 72,332 (1.7%) |
| Ubuntu 22.04 | 2,328,591 | `3ubuntu0.10` | 117,800 (5.1%) |
| Debian 12 | 1,163,297 | `deb12u3` | 94,098 (8.1%) |
| Ubuntu 23.10 | 13,156 | `1ubuntu3.6` | 514 (3.9%) |
| All four | 7,666,804 | | 284,744 (3.7%) |

The Ubuntu 24.04 ones are all on the build 24.04 shipped with in April 2024. Ubuntu's notes say 24.04 is believed not to be exploitable the way Qualys did it, because of how it starts sshd. Another 20,951 hosts run Ubuntu 22.10 or 23.04, whose 9.0p1 is in the range and whose support [ended](https://ubuntu.com/project/docs/release-team/list-of-releases/) before the fix. 609,156 announce a version in the range with nothing after it, so their banner carries no patch level, and we count them neither way.

Ubuntu's last security update for 22.04 and 24.04 before October 9 came out on September 3, and five weeks later it was on 78.8% of the 24.04 hosts (`3ubuntu13.19`) and 72.1% of the 22.04 ones (`3ubuntu0.17`). Debian 12's newest build, `deb12u10` from the May 16 point release, was on 60.2%.

## Past the end of support

2,974,010 OpenSSH hosts, 19.7%, announce one of seven releases that no longer get security updates without a subscription:

| Release | Hosts | Public updates ended | On the last public build |
|---|---|---|---|
| RHEL 7 family (`OpenSSH_7.4`) | 1,186,890 | June 30, 2024 (CentOS 7) | not in the banner |
| Ubuntu 20.04 | 764,779 | May 2025 | 72.1% (`4ubuntu0.13`) |
| Debian 11 | 370,477 | August 31, 2026 | 46.7% (`deb11u7`) |
| Ubuntu 18.04 | 246,342 | May 2023 | 39.5% (`4ubuntu0.7`) |
| Debian 10 | 149,841 | June 30, 2024 | 47.2% (`deb10u4`) |
| RHEL 6 family (`OpenSSH_5.3`) | 148,718 | November 30, 2020 (CentOS 6) | not in the banner |
| Ubuntu 16.04 | 106,963 | April 2021 | 39.7% (`4ubuntu2.10`) |
| All seven | 2,974,010 | | |

Older Debian and Ubuntu releases, interim Ubuntu ones included, add 305,616 more.

Subscriptions still patch some of them, and Ubuntu's banners show it. Builds from Ubuntu Pro's Expanded Security Maintenance carry `+esm`: 8,477 of the 20.04 hosts announce one (1.1%), 3,559 of the 18.04 ones (1.4%) and 1,210 of the 16.04 ones (1.1%). TuxCare's carry `+tuxcare`, on 4,312 of the 20.04 hosts and 3,898 of the 18.04 ones. Freexian's Extended LTS, which Debian's wiki calls ["a commercial offering"](https://wiki.debian.org/LTS/Extended), has shipped Debian 10 builds past `deb10u4`, and 1,031 hosts announce one (0.7%). It hasn't shipped a newer Debian 11 OpenSSH than LTS's last, `deb11u7` from May 15, so a Debian 11 server under it announces the same build as one without it. The RHEL 7 family's banner never shows the build: CentOS 7, Red Hat Enterprise Linux 7 under Red Hat's paid extended support, and Amazon Linux 2, whose support [ended](https://aws.amazon.com/amazon-linux-2/) on June 30, 2026, all announce `OpenSSH_7.4`.

## Finding old builds in your own ranges

SSH IP has the banner each host announced, so filtering it to the ranges you own or protect lists the hosts on a Debian or Ubuntu build from before their release's fix, or on a release past the end of its support. The same works for a customer's ranges, or a supplier's. A banner can be changed or hidden, and one load balancer can answer for many servers, so take it as what the host announces and check the machine: the package's changelog lists the CVEs each build fixes.

## How we counted

SSH IP's rows cover 90 days, and over that long a server that changes address counts twice, so we counted only the IPv4 hosts that completed a handshake between October 9 and 13. A release is read from the banner: `OpenSSH_9.6p1 Ubuntu-3ubuntu13.N` is Ubuntu 24.04's build N, and `OpenSSH_9.2p1 Debian-2+deb12uN` is Debian 12's. A banner with no revision is the release's first build, and one with something after the revision, an `+esm` or a vendor's rebuild, counts with its release. The RHEL families are their bare banners, which other systems built from the same versions can print too. Fix versions are from Ubuntu's and Debian's CVE pages, and support dates from [Ubuntu](https://ubuntu.com/about/release-cycle), [Debian](https://wiki.debian.org/LTS) and CentOS ([7](https://blog.centos.org/2023/04/end-dates-are-coming-for-centos-stream-8-and-centos-linux-7/), [6](https://centos.org/distro-faq/)), all read on October 17.

SSH IP is a gzipped CSV download, and [its docs](https://docs.internetdata.io/database/ssh-ip) list the columns. To license it, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).