OpenSSH 10.6 is out, with a hybrid post-quantum signature algorithm enabled and a change to SSH’s compression intended to mitigate side-channel leaks. The release also changes remote-copy behaviour and brings a small but useful SFTP improvement.
Watch Desk analysis
What happened
The OpenSSH project has released version 10.6, according to LWN’s report, published on 6 October. The project is also moving to more frequent releases, aiming to deliver bug fixes and updates to users sooner.
Our top picks
- Hybrid post-quantum signatures
The ssh-mldsa44-ed25519 algorithm is enabled, combining post-quantum and Ed25519 signatures. - LZ77 disabled in SSH and sshd
The change is intended to mitigate potential side-channel leaks. - Remote-to-remote scp -R deprecated
The option is being phased out because of security risks identified by the project. - New SFTP directory option
The lmkdir and mkdir commands now support -p. - More frequent releases
The project says a faster cadence should get fixes and updates to users sooner.
Why it matters
This release combines practical security changes with an early step towards post-quantum cryptography. Disabling the LZ77 dictionary coder is a mitigation, while enabling the hybrid signature gives users an additional algorithm option; neither should be mistaken for a sweeping security guarantee.
The scp -R deprecation is worth noting for anyone relying on remote-to-remote copies, as it may require a change to established workflows. The new SFTP option, by contrast, makes creating parent directories less fiddly. A rare release where the security notes and the small quality-of-life fix both deserve a look.
Our read
OpenSSH 10.6 is a meaningful update for system administrators and developers who maintain SSH-based access or file transfers. Check compatibility and scripts that use scp -R, and review the project’s release details before upgrading. Faster releases are only helpful if teams also have a sensible habit of applying them.
What to watch
- How quickly downstream operating systems and distributions package version 10.6.
- Whether the project shares further guidance on replacing scp -R workflows.
- How the hybrid post-quantum signature option is adopted by clients and servers.
Discussion spark: Would you prioritise adopting OpenSSH’s hybrid post-quantum signature now, or wait until it is more widely supported across your systems?
Sources and evidence
- OpenSSH 10.6 released (6 October 2026, 13:42 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.