OpenSSH 10.6 was released on 6 October 2026, and the security section of the release notes is long. Long lists make people nervous, so let's sort them by who actually needs to care.
Short version first: there is no "everyone patch tonight" bug here. Most fixes need a specific setup. But a few are worth knowing about.
Worth knowing for most admins
- sftp recursive copy: a malicious server could make a recursive download write files outside the folder you chose. If you pull files with
sftpfrom servers you don't fully trust, update your client. - Usernames with $ or \ on the command line are now rejected. This stops shell injection through ProxyCommand or Match exec. It matters if you have scripts that build ssh commands from user input.
- Compression side channel: with compression on and trusted and untrusted traffic sharing one connection, an attacker could learn secrets. OpenSSH disabled the dictionary coder that made it possible. If you rely on SSH compression, expect it to be a bit less effective.
- Decompression size limit: compressed data can no longer expand past the maximum packet size.
Only if you use these features
- GSSAPI / Kerberos login: two fixes so that a failed attempt can't leave credentials or state behind for a later login.
- "restrict" keys with tunnels: the
restrictoption in authorized_keys now fully applies to tunnel forwarding. PermitTunnel is off by default, so most servers are not affected. - "none" in Match blocks: options like AuthorizedPrincipalsFile now treat "none" correctly when overridden in a Match block, instead of reading it as a file name.
- ssh-keygen certificates: a daylight saving bug could set certificate expiry off by up to an hour.
- Old platforms like QNX 6, SCO OpenServer 5, or builds with fd passing disabled had a privilege issue. Rare in real life.
Do I need to install 10.6?
If you use your Linux distribution's OpenSSH package, usually no. Ubuntu, Debian, RHEL and others backport the security fixes into the version they ship. Your ssh -V may still show an older version number, and that's fine. On Ubuntu you can confirm with the package changelog:
zcat /usr/share/doc/openssh-server/changelog.Debian.gz | head -40Just keep security updates on. If you build OpenSSH yourself or run an appliance with its own SSH, check with the vendor.
My bigger tip
Whatever version you run, the best SSH protection is boring: don't expose port 22 to the internet, use keys instead of passwords, and limit which users can log in with AllowUsers. Do that, and most SSH bugs can't even reach you.
Personal view only. Always read the official release notes for the exact details.
Comments
No comments yet. Share your own debugging war story.