OpenSSH 10.6 adds post-quantum signatures, speeds releases

OpenSSH 10.6 came out on October 6, 2026, with a new post-quantum signature type and a change to how SSH compresses data. The project also says it will ship releases more often, because AI tools are now finding bugs faster. OpenSSH runs the remote logins on a vast number of servers, so these changes reach a lot of machines.

What OpenSSH 10.6 changes

OpenSSH is the free software behind the ssh command. It lets a person log in to another computer over an encrypted link, copy files and forward network traffic. The official release notes list the changes since version 10.5. The main ones are below.

Change	What it does
ssh-mldsa44-ed25519	A hybrid post-quantum signature algorithm for keys
LZ77 coder disabled	Turns off one part of SSH compression to block a data leak
WarnWeakCrypto	A new server option, on by default, that logs weak connections
Stricter sftp paths	Stops a server from writing files outside the target folder
Username check	ssh rejects $ and \ in usernames typed on the command line
Key file rounds	Default key-protection rounds rise from 24 to 32
scp -R deprecated	Warnings begin now; a later release will ignore the option

Post-quantum keys arrive

A signature algorithm proves who is on the other end of a connection. Today's algorithms could be broken by a large future quantum computer. Post-quantum algorithms are built to resist that kind of machine.

The new ssh-mldsa44-ed25519 type is a hybrid. It combines ML-DSA, a post-quantum design, with Ed25519, a widely used current one. An attacker would have to break both. The release notes say the name no longer carries the @openssh.com suffix used during testing. Keys made with that earlier experimental version must be made again or removed.

The server also gains WarnWeakCrypto, which is switched on by default. It writes a log line when a client connects using key agreement that is not post-quantum safe. Key agreement is the step where both sides settle on a shared secret.

Why compression got weaker

SSH can compress data before it encrypts it. Version 10.6 turns off the LZ77 dictionary coder, the part of compression that spots repeated text. The release notes say this blocks a "cross-channel plaintext recovery" attack, described in a research paper by Fabian Bäumer and Marcus Brinkmann. RuntimeWire reports that researchers demonstrated the weakness earlier this year.

The cost is that compression now saves less space. The project suggests compressing data inside the application instead.

The notes list several more fixes. sftp, the file transfer tool, now checks the paths a server sends back more strictly. Before, a recursive copy could write files outside the folder a user chose. Another fix stops decompressed data from growing past the maximum packet size.

AI bug reports change the release schedule

The release notes say the team has received many security reports made with AI models. Many have no real security impact, the notes add. Yet the team also warns that bugs found with AI are being found again by other researchers. That means attackers who never report bugs may find them too.

The project still wants the reports. "We very much welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes," the notes say. They add that "the OpenSSH team will, for now, be making more frequent releases to get bugfixes into users' hands more quickly." LWN's summary describes the volume as "a large number of AI-assisted security bug reports."

Other projects are feeling the same pressure. Earlier this month, Google paused its open-source bug bounty over AI reports.

What this means for developers

Most people will get 10.6 through their operating system's updates. A few checks are worth doing now:

• Plan for more updates. OpenSSH now expects to release more often. Teams that pin a version or bundle OpenSSH in images should update them more often too.
• Regenerate test keys. Anyone who tried the experimental post-quantum keys must create new ssh-mldsa44-ed25519 keys or remove the old ones.
• Watch the new log lines. With WarnWeakCrypto on, server logs will name clients that are not using post-quantum key agreement. That list shows which old clients and libraries to upgrade first.
• Check scripts that pass odd usernames. A command-line username with $ or \ now fails. Usernames set with the User line in a config file still work.
• Replace scp -R. Copying straight between two remote hosts with scp -R now prints a warning. A future release will route those copies through the local machine instead.
• Test slow links. Connections that rely on SSH compression may move more data now. Compressing files before sending them avoids the loss.

RuntimeWire notes that OpenSSH is built into many operating systems and commercial products. Appliance and router vendors may take longer to ship 10.6, so check with them for the update.