● Covered by 2 sources · 2 reportsMedium impact2 neutral
OpenSSH 10.6 Released, Deprecates scp -R Flag and Announces More Frequent Updates
Key points
- OpenSSH 10.6 released on October 6, 2026.
- Deprecates `scp -R` flag due to fragility and security risks.
- Removes `sshd` support for platforms not allowing file descriptor passing and requiring root for PTY.
- Increased release frequency planned due to AI-assisted security bug reports.
- OpenSSH 10.6 disables the LZ77 dictionary coder for SSH compression.
- OpenSSH 10.6 rejects '$' and '\' in command-line usernames.
OpenSSH 10.6 Release
OpenSSH 10.6 was released on October 6, 2026. This version is available from the official OpenSSH mirrors. OpenSSH provides a complete SSH protocol 2.0 implementation, including sftp client and server support.
Deprecation of `scp -R` Flag
The `scp -R` flag, used for remote-to-remote copies by executing `scp` on a remote host, is now deprecated. This flag is considered fragile and poses security risks due to credential requirements and potential shell quoting discrepancies. OpenSSH 10.6 will issue a deprecation warning, and in a future release, the flag will be ignored, reverting to copying via the client host.
Removal of Legacy Platform Support in `sshd`
Future releases will remove `sshd` support for platforms that do not allow file descriptor passing and require root privileges for PTY allocation. This primarily affects older operating systems like SCO OpenServer 5 and QNX 6. The OpenSSH team notes that this deprecation could be avoided if the user community for these platforms provides assistance.
Increased Release Frequency Due to AI-Assisted Bug Reports
The OpenSSH team has observed a significant increase in security bug reports, many generated or assisted by AI models. While some AI reports lack real-world security impact, the team acknowledges that AI tools can identify vulnerabilities that adversaries might also discover. Consequently, OpenSSH will adopt a more frequent release schedule to deliver bug fixes to users more rapidly, rather than batching them for planned releases.
Updates
- OpenSSH 10.6 disables the LZ77 dictionary coder for SSH compression.
- OpenSSH 10.6 rejects '$' and '\' in command-line usernames.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Primary sources
GitHub openssh/openssh-portable GitHub Yubico/libfido2 arXiv 2609.07709 CVE CVE-2025-264656.8 MEDIUM CVE CVE-2025-264665.9 MEDIUM CVE CVE-2023-384089.8 CRITICALHow outlets covered it
OpenSSH 10.6 was released with two deliberate breaking changes to enhance security: it disables the LZ77 dictionary coder for SSH compression and rejects certain characters in command-line usernames. These changes address vulnerabilities where compression state sharing could expose plaintext and special characters in usernames could lead to shell interpretation issues, respectively.
OpenSSH 10.6 has been released, introducing a deprecation warning for the `scp -R` flag and removing support for specific legacy platforms in `sshd`. The OpenSSH team will also increase release frequency due to a rise in AI-assisted security bug reports, aiming to deliver fixes more quickly.