libssh2 Publickey List Heap Corruption - PoC Binaries or Unexpected SSH Child Process

Ethan Andrews@eandrews

•updated Jun 28, 2026•0•0•1

Detects evidence of libssh2 publickey list heap corruption exploitation, including the presence or execution of known proof-of-concept (PoC) binaries, malicious SSH server connection patterns on port 2228, and suspicious child processes (e.g., cmd.exe, calc.exe) spawned by SSH clients or daemons.