OpenSSH 10.6 speeds security releases as Google pauses OSS bug bounty intake

Automated vulnerability reporting is forcing open-source security programs to change both intake and release cadence. OpenSSH 10.6 responds to a surge in AI-assisted reports by planning more frequent releases, while Google temporarily stopped accepting product vulnerability reports for its open-source bug bounty program after most automated submissions proved invalid. The result is a higher premium on human triage, reproducible tests, and fixes that maintainers can act on.

• OpenSSH 10.6 enables the hybrid post-quantum ssh-mldsa44-ed25519 signature algorithm and adds a -p option to sftp lmkdir and mkdir commands.
• OpenSSH 10.6 disables the LZ77 dictionary coder in ssh and sshd to mitigate side-channel leaks, reducing the effectiveness of the Compression option; scp -R is being deprecated because of security risks.
• The OpenSSH team says it is receiving a large number of AI-assisted security bug reports and expects to release updates more frequently instead of batching fixes, especially when reports include human triage, analysis, test cases, and proposed fixes.
• Google temporarily stopped accepting product vulnerability reports through its open-source bug bounty program on October 1 after a significant rise in automated submissions, the vast majority of which it said were invalid; supply-chain compromise reports remain eligible and earlier submissions are unaffected.

Bottom line If you operate OpenSSH, review the 10.6 security and compatibility changes now; if you submit vulnerability reports, add human validation, reproducible tests, and a proposed fix before filing.