CVE-2026-55200 libssh2 OOB Write - Exploit Tooling and Post-Exploitation Canary

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•10

Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.