OpenSSH 10.3 Fixes Shell Injection and Multiple SSH Security Issues

OpenSSH 10.3 (released April 2, 2026) patches a shell-injection vulnerability in the -J/ProxyJump command-line option, tightens validation of certificate principals (preventing empty-principals from acting as wildcards and clarifying wildcard support), and removes backward-compatibility for implementations that do not support transport-layer rekeying; administrators should prioritize updating, review any programmatically constructed ProxyJump inputs and existing CA-issued certificates, and obtain the release from official mirrors.