Critical Zero-Day in Widely Used SSH Library Under Active Exploitation

A remote code execution vulnerability in libssh-lite, a lightweight SSH implementation embedded in dozens of continuous-integration tools and edge appliances, is being actively exploited against build infrastructure, according to researchers at three separate incident-response firms who briefed Lunaro News ahead of a coordinated disclosure.

The flaw, tracked as a heap buffer overflow in the library's key-exchange handshake, allows an attacker who can reach a vulnerable server on the network to execute arbitrary code before authentication completes. That detail matters: exploitation does not require valid credentials, only network reachability, which is precisely the condition many internal build servers and self-hosted runners were never designed to defend against.

Researchers say the earliest confirmed exploitation attempts date back roughly ten days, well before any public advisory existed, suggesting the bug was independently discovered and weaponized outside the usual coordinated-disclosure pipeline. The observed intrusions have focused less on data theft and more on quietly modifying build pipeline configurations, a pattern consistent with software supply-chain poisoning rather than opportunistic ransomware.

The maintainers of libssh-lite, a two-person team that maintains the project as a side effort, pushed an emergency patch within eighteen hours of being notified. Downstream, the picture is messier: the library ships embedded inside several popular CI runners and a widely used self-hosted Git server, meaning many operators will not get a fix through a simple package update and will instead need to wait on, or manually apply, vendor-specific rebuilds.

Security teams are being urged to isolate build infrastructure from the general internet where possible, rotate any credentials that touched affected runners in the last two weeks, and treat build artifacts produced during that window as unverified until re-audited. Given how build servers sit upstream of production deployments, the practical blast radius of this bug extends well past the systems it directly compromises.

Lunaro News will update this article as the coordinated disclosure timeline progresses and as affected vendors confirm patched releases.