OpenSSH 10.4 was released on July 6, 2026, and 10.5 on August 11, 2026. Both are already reaching servers through distribution updates, and between them there are three changes the project itself flags as potentially incompatible. They're worth reading before you upgrade, because when sshd breaks, the cost is that you can't get in to fix it.

Three Potentially-Incompatible Changes in 10.4

  • Config dump mode now uses mixed-case directives. sshd -T and ssh -G now emit PubkeyAuthentication rather than all-lowercase. Any script that asserts configuration with sshd -T | grep pubkeyauthentication will silently stop matching — no error, just a permanent miss, after which your compliance check or automation quietly reaches the wrong conclusion. Switching to grep -i fixes it.
  • On Linux, seccomp sandbox failures are now fatal instead of permitting continued operation. sshd used to degrade and keep serving when the sandbox couldn't initialise; now it stops. On older kernels, restricted containers and some virtualisation platforms, that means sshd may refuse to start after the upgrade. The direction is right — a silently disabled sandbox is a security assumption you no longer have — but you need to know before, not after.
  • Stricter transport handling: non-KEX messages during post-authentication rekeying now cause a disconnect. Well-behaved clients won't trip on this, but older libraries, jump-host tooling and long-lived sessions might drop after running for a while. If sessions start dying after an hour or two post-upgrade, look here first.

10.4 also carries three security fixes: sftp download-location manipulation by a malicious server, scp remote-to-remote restrictions, and internal-sftp command-line argument truncation affecting security options. That last one deserves attention: if you build restricted SFTP accounts by passing arguments to internal-sftp, truncation means restrictions you believed were applied may never have taken effect.

What Changed in 10.5

10.5 has exactly one potentially-incompatible item: portable OpenSSH now requires ECC support in libcrypto, including the NISTP521 curve. Distribution packages are unaffected; if you build against a trimmed-down OpenSSL, the build now fails outright.

The most useful new feature is ssh -Z, which prints the keys tried during public key authentication, in order. That directly addresses the most common flavour of Permission denied (publickey): too many local keys, seven or eight identities loaded in ssh-agent, and the server's MaxAuthTries (default 6) exhausted before the correct key gets its turn. Previously you counted the order out of ssh -vvv output; now one flag shows it.

The rest of 10.5: ssh-keygen can set or clear the touch-required and verify-required flags on FIDO private keys; certificate authentication now prefers lower-friction FIDO keys first; and sshd uses setproctitle(3) to identify the post-authentication monitor as sshd-session, which makes process lists much easier to read.

The Discipline of Upgrading sshd (More Important Than the Version Number)

  • Always keep one established session open. After upgrading and restarting sshd, open a brand new window and connect again; only close the original once the new one works. Existing connections survive an sshd restart — that's your safety rope.
  • Syntax-check before restarting: sudo sshd -t. To read the effective configuration, use sudo sshd -T (remembering the case change above).
  • On containers or older kernels, verify seccomp availability first, or you'll run straight into the fatal-sandbox change.
  • Know your out-of-band path in advance. Your provider's VNC or serial console and rescue mode should be something you've already used once, not something you're learning about during an outage.

If You Do Get Locked Out

Start by separating a network-layer problem from an SSH-service problem, because the two lead in completely different directions. Can't SSH into your VPS? A step-by-step checklist gives the full order — local network, firewall, port, then service state — while what to do when your VPS won't connect (SSH timeout) focuses on timeout-shaped symptoms. For prevention — key-based login, ufw rules, whether changing the port is worth it — see VPS security hardening: ufw firewall and SSH key login. Every SharkCloud instance is reachable from the console, so even a completely dead sshd doesn't mean reinstalling the system.