OpenSSH 10.6 disables LZ77 compression and rejects shell metacharacters in usernames to close two holes

OpenSSH 10.6, released on October 6, 2026, disables the LZ77 coder in SSH compression and rejects dollar and backslash characters in command-line usernames. If your automated transfers rely on SSH compression or your scripts build usernames from external input, check both before you upgrade.