A critical zero-day vulnerability (CVE-2025-38897) has been discovered in OpenSSH, affecting most Unix-based systems running versions 9.3 and earlier. The flaw allows unauthenticated remote code execution under specific conditions, posing a serious risk to public-facing servers. The exploit has already been seen in active use by threat actors.