SSH trust across silos, after the year of OpenSSH bugs

In February 2025 Qualys TRU disclosed CVE-2025-26465 (a machine-in-the-middle flaw where the client can accept an attacker's key, breaking connection integrity) and CVE-2025-26466 (a pre-auth denial of service), on top of 2024's regreSSHion RCE (CVE-2024-6387). SSH trust between silos is exactly where a key-confusion bug bites.

1. Where silos trust via SSH. Automation, admin access and file transfer across boundaries.
2. The 2025 key-confusion flaw. How a MitM makes the client trust the wrong key.
3. Host-key verification done right. Known-hosts, pinning, and why it is skipped.
4. Certificate-based SSH. Short-lived certs instead of sprawling authorized_keys.
5. PKI hygiene across the boundary. Issuance, rotation, revocation that actually works.

A cryptography and security piece that grounds the cross-silo auth plumbing in a concrete 2025 vulnerability. It shows the practical, hands-on detail (host keys, SSH certs, PKI) that signals experienced practitioners rather than slideware.

• Anchor on the OpenSSH MitM flaw; it maps perfectly to cross-silo trust.
• Push certificate-based SSH over key sprawl as the direction.
• Cover revocation, the part everyone gets wrong.
• Keep it concrete and hands-on; that is the credibility signal.