CVE-2026-55200: curl/git/php Outbound SSH to External Host (libssh2 Transitive RCE)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•2•0•3

Detects outbound network connections over standard SSH ports (22, 2222) initiated by process names typically associated with web requests or package management (curl, git, php), potentially indicating unauthorized remote access, lateral movement, or data exfiltration from a compromised host to an external, non-private network address.