OPENBSD 8.0 arrived on 20 October 2026 with notable kernel hardening and new features, but the release was accompanied by four critical day-one errata. The most serious patch fixes a memory corruption flaw in the IPsec AES-GMAC implementation. Under targeted conditions, processing remote IPsec packets could trigger a kernel buffer overflow, potentially affecting amd64 systems with AES-NI and Octeon machines that use hardware cryptographic accelerators. The standard AES-GCM implementation remains unaffected. Administrators are advised to apply the binary fixes promptly using the syspatch utility.
In addition to the IPsec fix, the OpenBSD project released three further immediate corrections covering NSD DNS server errors, a use-after-free issue in video drivers, and a buffer overflow in PPP. These fixes are described in the OpenBSD 8.0 errata documentation and are designed to be deployed via the same day-one patching mechanism.
OpenBSD continues to emphasise enhanced security, with changes across core network daemons such as httpd and smtpd, including re-linking executables on reboot to disrupt reliance on static memory offsets. OpenSSH has also been updated to 10.6, introducing post-quantum considerations and stricter parsing and timeouts, as well as removing LZ77 compression to reduce side‑channel leakage.
Other notable changes include the vmd hypervisor scaling up to 64 vCPUs per guest, expanded kernel virtual address space on amd64, and memory mapping randomisation aimed at preventing privilege escalation. LibreSSL 4.4.0 adopts a hybrid X25519MLKEM768 key exchange strategy for TLS 1.3. Overall, the release delivers substantial hardware and cryptographic enhancements alongside the critical day-one fixes.