Almost 11 million internet-exposed SSH servers are vulnerable to the exploitation of a vulnerability known as Terrapin, which compromises the integrity of SSH connections. The flaw, tracked as CVE-2023-48795, targets both SSH clients and servers. It works by manipulating sequence numbers during the handshake process, affecting connections using encryption modes like ChaCha20-Poly1305 or CBC with Encrypt-then-MAC. This vulnerability allows attackers to downgrade public key algorithms for user authentication, disabling defenses against keystroke timing attacks in OpenSSH 9.5. For the attack to be successful, the attacker must be in an adversary-in-the-middle (AiTM) position to intercept and modify the handshake exchange. The nearly 11 million vulnerable SSH servers represent approximately 52% of all samples in the IPv4 and IPv6 space. These vulnerable systems are predominantly located in the United States, but are also found in China, Germany, Russia, Singapore, and Japan. The scale of unpatched devices hints to the potential widespread impact of Terrapin attacks. While not every exposed server is immediately at risk, the large number of vulnerable servers provides a substantial target pool for threat actors. The Terrapin researchers who first identified the vulnerability at Ruhr University Bochum in Germany have provided a vulnerability scanner for assessing the susceptibility of SSH clients and servers to Terrapin attacks. Technical details of the attack can be found in the report linked below. CTIX analysts recommend that organizations ensure that they have patched this flaw and take the necessary steps to identify all vulnerable instances across their infrastructure.