OpenSSH 10.5 was released on 2026-08-11, available from the mirrors at openssh.com. The project has received many security bug reports from AI models or with AI assistance. While many lack security impact in a realistic threat model, the team welcomes these reports, especially when combined with human triage and fixes. They note that bugs found by AI are sometimes independently discovered by other researchers, meaning adversaries may also find them. Consequently, OpenSSH will now make more frequent releases to get fixes to users faster.

Potentially-incompatible changes: Portable OpenSSH now requires ECC support in libcrypto, including the NIST P521 curve. Security fixes include: ssh-agent fix for interaction between agent locking and the session-bind extension (reported by sn0x-sharma); ssh realloc use-after-free fix in client remote forwarding (report and fix from Brian Mingus of Cognatory); sshd authorized_keys "restrict" keyword now applies correctly to tunnel forwarding (reported by Erichen).

New features: ssh-keygen can set or clear touch-required and verify-required flags on FIDO keys; ssh now tries low-friction FIDO keys first; "ssh -Z user@host" prints authentication key order; sshd-session uses setproctitle. Bugfixes: ssh-keyscan non-blocking server banner reads; sshd uses sshpkt_fatal; GSSAPI option names fixed; ed25519 key generation error handling; key parsing moved pre-auth; double frees fixed; Channel Timeout and Rekey Limit in Match blocks; PAMServiceName reallowed in Match blocks.