Ubuntu 26.04 ships OpenSSH 10.2p1 with post-quantum key exchange enabled by default, but defaults alone will not save you. I verify every command on a live VM, covering Ed25519 key generation, agent socket security, host key verification, forwarding risks, and the CVE-2026-46333 kernel patch you need to check today.