OpenSSH version 10.6 was released on Oct. 6 with a faster release cadence to deliver bug fixes sooner, after receiving many security reports including issues found with AI assistance. The update weakens Compression by disabling the LZ77 dictionary coder, tightens username handling and path validation, fixes several credential and certificate issues, and enables the hybrid post-quantum signature algorithm ssh-mldsa44-ed25519. #OpenSSH #sshd #ssh-keygen #ssh-mldsa44-ed25519
Keypoints
- OpenSSH 10.6 will be followed by more frequent releases.
- Compression now disables the LZ77 dictionary coder to reduce cross-channel attacks.
- ssh refuses usernames containing $ or from the command line.
- sshd, sftp, and ssh-keygen received fixes for credential, path, and certificate handling.
- Hybrid post-quantum support ssh-mldsa44-ed25519 is now enabled.
Read More: https://www.helpnetsecurity.com/2026/10/07/openssh-10-6-released/