In the news, but not on CISA's list of exploited flaws yet. Treat it as urgent if you run it.
89%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2016-6210. Nothing runs until you send it.
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exist, which allows remote attackers to enumerate users by leveraging the timing difference between responses when a large password is provided.