By OpenSSH 10.6 landed on October 6th with two changes that need your attention. LZ77 compression is disabled — not because it stopped working, but because researchers published a real attack showing how SSH’s shared compression dictionary leaks secrets between session channels. And the hybrid post-quantum signature algorithm ssh-mldsa44-ed25519 is now stable, which sounds like good news until you realize it breaks experimental post-quantum keys generated under OpenSSH 10.4.
The Compression Attack, Explained
The underlying research is called “Crossing the Streams” (arXiv 2609.07709), by Fabian Bäumer and Marcus Brinkmann. The attack works because SSH’s LZ77 compressor maintains a single dictionary across all channels of a connection. That shared state lets an attacker who controls traffic on one channel measure ciphertext length changes on another — and from those measurements, reconstruct secrets.
In their lowest-noise test case, the researchers recovered an eight-character secret from a 26-character alphabet in no more than 276 guesses. That’s not a theoretical edge case — that’s a graduate student with a laptop.
OpenSSH’s response is direct: disable the shared LZ77 dictionary entirely. Compression still works, it’s just less effective without cross-channel state. The team recommends pushing compression to the application layer — rsync already does this with -z, and git handles it internally. If you’re using SSH-level compression to save bandwidth on binary transfers, it’s time to revisit that assumption.
Post-Quantum Signatures: Stable, but Your Old Keys Are Broken
The hybrid algorithm ssh-mldsa44-ed25519 — combining NIST-standardized ML-DSA 44 with Ed25519 — moves from experimental to stable in 10.6. If you never touched post-quantum SSH keys, there’s nothing to do here except optionally generate new ones.
If you ran the 10.4 experiment, there is something to do: those keys used an @openssh.com vendor suffix in the algorithm name. That suffix is gone in 10.6, and the format change makes your experimental keys incompatible. Delete them and regenerate:
ssh-keygen -t mldsa44-ed25519 -f ~/.ssh/id_mldsa44-ed25519OpenSSH 10.6 also adds WarnWeakCrypto to sshd_config, enabled by default. It logs connections that negotiate non-post-quantum-safe key exchange algorithms. No connections are blocked yet — it’s a visibility tool. But the direction is obvious: audit now before it becomes enforcement.
Three More Fixes Worth Checking
Three smaller fixes have outsized relevance depending on your setup:
- Username shell injection: Dollar signs and backslashes are now blocked in command-line usernames. This matters if you’re using
ProxyCommandorMatch execdirectives with user-controlled input — previously a route to shell injection. - SFTP path traversal: A malicious SFTP server could return crafted paths to redirect a recursive copy operation outside its target directory. Validation is now strict enough to block this.
- GSSAPI credential leakage: Failed Kerberos authentication attempts were leaving credentials in session state. If a subsequent authentication method succeeded on the same connection, those lingering credentials could be unexpectedly available. Fixed.
Also worth noting: private key KDF rounds increase from 24 to 32 for new keys (stronger encryption at rest), and scp -R for remote-to-remote copies is deprecated with a warning. Start migrating those scripts to rsync now.
What to Do Now
# Update OpenSSH (Debian/Ubuntu)
sudo apt update && sudo apt install openssh-client openssh-server
# If you generated experimental PQ keys under OpenSSH 10.4
rm ~/.ssh/id_mldsa44-ed25519*
ssh-keygen -t mldsa44-ed25519 -f ~/.ssh/id_mldsa44-ed25519
# Verify WarnWeakCrypto is active (default-on in 10.6)
grep WarnWeakCrypto /etc/ssh/sshd_configPriority should go to bastion hosts, jump boxes, and any server that accepts connections from untrusted clients — those have the highest exposure to the compression and username injection issues.
The Bigger Picture
The OpenSSH team has signaled that release cadence is accelerating. AI-assisted security research is surfacing vulnerabilities faster than traditional audit cycles, and the team is matching pace. This release alone fixes eight distinct security issues. That’s not a sign that SSH is broken — it’s a sign that the security community is looking harder than ever.
WarnWeakCrypto logging today will become a rejection threshold in some future version. Now is the time to understand which systems still negotiate classical key exchange and make a plan. The post-quantum transition isn’t urgent this week, but it’s no longer something you can defer indefinitely. The full release notes are worth reading — there’s more in 10.6 than most coverage has covered.
