OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing
OpenSSH 10.6 disables risky compression, blocks shell-injecting usernames, and enables a post-quantum signature.
OpenSSH 10.6, released October 6, 2026, ships several security fixes and the maintainers said releases will come more often after a surge of reports, many found with AI help. ssh and sshd disable the LZ77 compression dictionary because a shared dictionary lets an attacker who controls one channel recover secrets from another via ciphertext length. The client also rejects command-line usernames containing $ or \ to limit shell injection through ProxyCommand or Match exec, stores GSSAPI credentials only after authentication, tightens sftp path checks, and enables the hybrid signature ssh-mldsa44-ed25519, so experimental keys must be regenerated or removed.
- LZ77 dictionary coder disabled after a cross-channel secret-recovery attack
- Command-line usernames containing $ or backslash are refused
- GSSAPI credentials are stored only after authentication succeeds
- ssh-mldsa44-ed25519 enabled; experimental keys must be replaced
- Maintainers cite many reports, including AI-assisted bug finds
Full article404 words · extracted from helpnetsecurity.com · click to collapse
The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have received a large number of security reports, many found by AI models or with AI help, and in a number of cases a different researcher independently found the same bug later.
Adversaries who do not report bugs to open-source projects, the maintainers wrote, “are likely to be able to discover these bugs too.” If you run sshd or the ssh client, expect updates on a shorter cycle.
Compression gets weaker
Both programs now disable the LZ77 dictionary coder, so the Compression option is less effective. Fabian Bäumer and Marcus Brinkmann described an attack in which someone who controls input on one channel can recover secrets from another. Every channel in a session shares one compression dictionary, and repeated strings change the length of the ciphertext. The maintainers recommend application-level compression, which they say is typically more effective and immune to this attack.
Usernames with $ or \ are refused
ssh now refuses command-line usernames containing a dollar sign or backslash, because a name from an untrusted source could inject into a shell context through ProxyCommand or Match exec. Names set with the User directive in config files are exempt. The maintainers say a mitigation like this cannot be absolute.
Other fixes
sshd now stores GSSAPI credentials only after authentication succeeds. Before, credentials from a failed attempt could persist and be exposed after a later success. sftp validates server-returned paths more strictly, closing cases where a server could steer a recursive copy outside its target directory. ssh-keygen mishandled Daylight Saving Time, so certificates could carry expiry times off by up to an hour, or two hours in the Antarctica/Troll timezone.
On QNX 6, SCO OpenServer 5 and builds made with –disable-fd-passing, the post-authentication process keeps root, so GatewayPorts and StreamLocalForwarding are now disabled there. Support for those platforms will be removed in future if no alternative is found.
The release also enables the hybrid post-quantum signature algorithm ssh-mldsa44-ed25519. Keys generated with the earlier experimental support must be regenerated or removed.
Must read:
- 20 open-source cybersecurity tools to keep your team ready for anything
- GitHub CISO on security strategy and collaborating with the open-source community
Subscribe to the Help Net Security ad-free monthly newsletter to stay informed on the essential open-source cybersecurity tools. Subscribe here!