A public PoC is out for CVE-2026-55200, a libssh2 client-side parsing bug where a hostile SSH server can drive a packet length overflow into a heap write. The article is useful because it separates the local harness from reliable live exploitation, then points at the hard part everyone hates most, finding bundled or statically linked copies.