TECHNOLOGY · AI · CYBERSECURITY · THE SYSTEMS SHAPING BUSINESS
OpenSSH 10.6, released Tuesday, turns on a hybrid post-quantum signature algorithm by default and disables part of SSH compression to close a side channel that could expose data across connections, Help Net Security reported Wednesday. The update also includes several security fixes and a commitment from the project to ship releases more often.
What Happened
The headline change is the default use of ssh-mldsa44-ed25519, a composite signature scheme that pairs ML-DSA-44, the lattice-based algorithm standardized by NIST, with the classical Ed25519 algorithm. According to the release notes, the name no longer carries the @openssh.com vendor suffix used by the earlier experimental version, so keys created with that version must be regenerated or removed.
A new sshd option, WarnWeakCrypto, is enabled by default and logs when a client connects using a key agreement method that is not post-quantum safe.
RelatedThe release also disables the LZ77 dictionary coder used in SSH compression. Researchers Fabian Bäumer and Marcus Brinkmann showed that because multiplexed channels share a compression dictionary, someone who controls input on one channel can recover plaintext from another. The project warned that compression will be less effective as a result and suggested compressing at the application level where needed.
Security Fixes
Usernames given on the command line may no longer contain dollar signs or backslashes, closing a route to shell injection through ProxyCommand and Match exec settings. Usernames set in configuration files are not affected. The issue was reported by a researcher at Tencent's KeenLab.
Other fixes tighten how sftp validates paths returned by a server, so a malicious server cannot make a recursive download write files outside the target directory, and change GSSAPI handling so credentials are stored only after authentication succeeds. A daylight saving time bug in ssh-keygen that could shift certificate expiry times by up to an hour was also fixed; the release notes say the error could reach two hours only in Antarctica's Troll time zone.
The notes credit Chris Rohlf, working with Claude and Anthropic Research, for checks that validate signature algorithms while keys are being parsed.
Why It Matters
OpenSSH is the standard remote-access tool on Linux and BSD systems and also ships with Windows and macOS, so its defaults shape how a large share of servers authenticate. Earlier releases moved key exchange to post-quantum hybrids, with version 10.0 making an ML-KEM-based method the default in 2025. Version 10.6 extends that protection to signatures, which authenticate hosts and users.
The hybrid design means a connection stays secure as long as either ML-DSA-44 or Ed25519 holds, which hedges against weaknesses in the newer lattice scheme while guarding against future quantum attacks on classical signatures.
The project's reason for releasing more often is also notable. The release notes say security bugs identified by AI tools have later been found independently by other researchers, which suggests adversaries are likely able to discover them as well.
Other Changes
New features include an AgentSocketPath option, a -P flag for ssh-add to skip PIN entry on FIDO and PKCS#11 tokens that do not need it, mkdir -p in sftp and fractional-second values for ChannelTimeout. The scp -R option for remote-to-remote copies now triggers a deprecation warning. On platforms that cannot pass file descriptors between processes and need root to allocate terminals, GatewayPorts and StreamLocalForwarding are disabled, and support for such platforms, including SCO OpenServer 5 and QNX 6, is slated for removal.
What to Watch
Linux distributions and operating system vendors typically package new OpenSSH releases over the following weeks. Administrators who tested experimental ML-DSA keys will need to reissue them, logs may start flagging clients that use older key agreement and workloads that rely on SSH compression may see lower ratios.
