OpenSSH 10.6 Fixes Security Flaws Including SSH Plaintext Recovery Attack

OpenSSH 10.6 (released Oct 6, 2026) patches a critical cross-channel plaintext recovery vulnerability that abuses a shared LZ77 compression context in multiplexed SSH channels by disabling the LZ77 dictionary coder; the release also tightens SFTP path validation, authentication state handling, username filtering, packet length checks, and disables certain privileged forwarding on legacy platforms, while deprecating scp -R and accelerating security release cadence.