OpenBSD 8.0 adds hardening and experimental post-quantum SSH
Original title: OpenBSD 8.0 Released With Major Security Hardening and Post-Quantum SSH Support
The October 20 release ships OpenSSH 10.6 and LibreSSL 4.4.0, including an OCSP authorization-bypass fix and kernel memory fixes.
OpenBSD 8.0, the project’s 61st release, was published on October 20 with fixes across the kernel, network services, PF, and update tools. OpenSSH 10.6 adds experimental mldsa44-ed25519 signatures, switches that scheme to an IANA codepoint, and disables the LZ77 dictionary coder over a possible side channel. The kernel randomizes the amd64 direct memory map, fixes stack leaks, and removes an unprivileged memory read and write on m88k 88100. LibreSSL 4.4.0 prefers X25519MLKEM768 in libtls and fixes an OCSP responder authorization bypass.
- PF fixes cover out-of-bounds reads, counter races, and crafted TCP resets.
- httpd rejects ambiguous framing; relayd rejects duplicate Content-Length headers.
- Firmware updates now verify local SHA256.sig signatures and limit downloads.
- pax blocks archives that extract files outside the working directory.
- Package installs no longer search the current directory by default.
Impact: Kernel memory access, leaks, and flawed firewall or HTTP handling
| Product | Affected | Fixed in |
|---|---|---|
| OpenBSD | — | 8.0 |
| OpenBSD OpenSSH | — | 10.6 |
| OpenBSD LibreSSL | — | 4.4.0 |
- 1.Review compatibility changes, upgrade documentation, and release errata before production deployment.
- 2.Testers of earlier post-quantum SSH signatures should review the IANA codepoint change.
From the original article
2 min read at cybersecuritynews.com
OpenBSD 8. 0 has been released with security fixes across its kernel, network services, firewall, and update tools, alongside experimental post-quantum SSH signature support. Released on October 20, 2026, the project’s 61st release includes OpenSSH 10.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.