OpenSSH 10.6 Deliberately Breaks Two Features in the Name of Security
The New Stack, Wednesday, October 7th, 2026
OpenSSH 10.6 disables compression dictionary sharing and rejects some usernames, knowingly breaking existing setups.
OpenSSH 10.6 ships two changes its maintainers knew would break things, starting with disabling the LZ77 dictionary coder for SSH compression after researchers found that sharing compression state across channels could expose plaintext.
It also blocks $ and \ in command-line usernames so they can't be interpreted by the shell through directives such as ProxyCommand and Match exec.
With AI-assisted security research finding more exploitable flaws, the project plans to ship fixes more often, and admins should check compression settings and username handling in scripts before upgrading.