OpenSSH 10.6
Package
OpenSSH 10.6 enables the hybrid ssh-mldsa44-ed25519 post-quantum signature algorithm, adds WarnWeakCrypto to sshd, fixes an sftp path traversal and a compression plaintext recovery attack, and deprecates scp -R.
Download TAR.GZ Project website ↗Download Mirrors
OpenSSH 10.6 was released on October 6, 2026, following OpenSSH 10.5. We covered it in the news.
What changed
- The hybrid
ssh-mldsa44-ed25519post-quantum signature algorithm is enabled; keys from the earlier experimental variant must be regenerated WarnWeakCryptoin sshd logs clients using non-post-quantum key exchange- sftp validates server paths so recursive downloads cannot escape the target directory
- LZ77 compression is disabled to block a plaintext recovery attack
- Command-line usernames containing
$or\are rejected scp -Ris deprecated
Should you build it?
Almost never. Use your distribution’s OpenSSH packages, which receive security fixes without replacing the system’s configuration. Building from source is for packagers and testing:
tar xzf openssh-10.6p1.tar.gz && cd openssh-10.6p1
./configure --prefix=/opt/openssh
make && sudo make installOur SSH hardening guide covers configuration either way.
Verify Your Download
Each tarball on the OpenBSD mirror has a matching .asc signature from the OpenSSH release key, and SHA256 checksums are listed in the release notes.