New security bug threatens to be as widespread as Heartbleed

Zoom in: Researchers at Qualys discovered a bug in a popular OpenSSH server — which many organizations use to secure communications and manage remote access — that would allow attackers to gain complete control of the system the code is running on.

• The flaw — dubbed "regreSSHion" — affects how systems authenticate a user's identity and has a severity score of 8.1 out of 10.
• OpenSSH has fixed the issue, but it requires users to update to the latest version as soon as possible.

Threat level: More than 14 million instances of the vulnerable OpenSSH tool were running online as of Monday.

• Once they exploit the flaw, hackers could install malware, manipulate data, and create backdoors to keep accessing corporate networks.
• However, exploiting the bug is challenging because it requires multiple attempts to get right, Qualys noted, but advancements in deep learning could speed up exploitations.

What we're watching: Some experts have already warned this issue could be as widespread as Heartbleed — a 2014 vulnerability believed to have affected roughly 500,000 websites running an open-source encryption tool.