OpenSSH 10.6 Addresses Security Flaws and Introduces Post-Quantum Algorithm

• •OpenSSH 10.6 fixes critical vulnerabilities, including a plaintext recovery attack.
• •The update disables LZ77 compression to mitigate cross-channel attacks.
• •A new hybrid post-quantum signature algorithm is introduced, requiring key regeneration.

OpenSSH released version 10.6 on October 6, 2026, to fix multiple security vulnerabilities impacting SSH encrypted sessions, including a plaintext recovery attack leveraging shared compression states across multiplexed channels. The attack, detailed by researchers Fabian Bäumer and Marcus Brinkmann, allows an attacker to exploit dictionary-based compression to recover sensitive data from different channels. The update disables the LZ77 dictionary coder, making the Compression option less effective, and recommends application-level compression instead. Other security enhancements include stricter validation of server-returned paths in SFTP, improved handling of GSSAPI credentials, and rejection of command-line usernames containing dollar signs or backslashes to mitigate shell injection risks. The release also introduces a hybrid post-quantum signature algorithm, necessitating the regeneration of experimental keys. OpenSSH maintainers noted an increase in security reports, many identified with AI assistance, indicating a proactive approach to vulnerability management.