An alleged sale of unpatched critical zero-day exploits targeting Floci, Gitea, libssh, and c-ares highlights a growing threat. While the zero-day claims on dark web forums are likely fraudulent, the weaponization of legitimate public research repositories poses an immediate risk to enterprise networks.
Vulnerable client connects to malicious SSH server
Standard key exchange initiated without credentials
Server sends excessive packet_length (0xffffffff)
Client arithmetic wraps, allocating undersized heap buffer
Client copies packet, writing beyond allocated bounds
Corrupted callback pointers hijack execution flow
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.