Follow the latest coverage, related explainers and connected technology stories.
OpenSSH 10.6 disables the LZ77 component of compression shared between SSH session channels after it was shown to be usable for recovering secret data. It also rejects the $ and \ characters in usernames passed through the command line to reduce the risk of shell command injection. Some automation tasks may be affected, along with other changes concerning post-quantum keys and the scp tool.