OpenSSH 10.6 strengthens file path and authentication handling: test remote maintenance scripts first
OpenSSH 10.6/10.6p1 fixes SFTP path, GSSAPI and other security handling, and begins deprecation warnings for scp's -R option. Businesses updating remote maintenance tools should also validate automated file transfers and sign-in workflows.
Source Facts
OpenSSH released 10.6 / 10.6p1 on 6 October. Security changes include stricter checks on paths returned by SFTP servers and improvements to GSSAPI authentication state and credential handling. Compression behaviour was also adjusted to reduce information disclosure risks in shared compression contexts.
The release notes also begin deprecating scp's -R option. It still works for now but produces a warning; in future it is expected to be ignored in favour of the default remote-to-remote copying behaviour. This is migration guidance, not an indication that the new version has already removed the feature.
Before upgrading remote maintenance tools, test login, batch file transfers and error-output handling to prevent older scripts from silently failing after security updates.
Original sources
OpenSSH 10.6/10.6p1 Release Notes — 2026-10-06
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration