OpenSSH 10.6 enables a post-quantum signature algorithm, so experimental keys need replacing

The OpenSSH team released version 10.6 on Oct. 6 and said it will ship releases more often for now to get bugfixes into users’ hands more quickly. The maintainers have received a large number of security reports, many found by AI models or with AI help, and in a number of cases a different researcher independently found the same bug later.

Adversaries who do not report bugs to open-source projects, the maintainers wrote, “are likely to be able to discover these bugs too.” If you run sshd or the ssh client, expect updates on a shorter cycle.

Compression gets weaker

Both programs now disable the LZ77 dictionary coder, so the Compression option is less effective. Fabian Bäumer and Marcus Brinkmann described an attack in which someone who controls input on one channel can recover secrets from another. Every channel in a session shares one compression dictionary, and repeated strings change the length of the ciphertext. The maintainers recommend application-level compression, which they say is typically more effective and immune to this attack.

Usernames with $ or \ are refused

ssh now refuses command-line usernames containing a dollar sign or backslash, because a name from an untrusted source could inject into a shell context through ProxyCommand or Match exec. Names set with the User directive in config files are exempt. The maintainers say a mitigation like this cannot be absolute.