OpenBSD 8.0 launched on October 20, 2026, delivering sweeping security upgrades across the kernel, network services, firewall systems, and update tooling, plus experimental post-quantum SSH signature support. It includes OpenSSH 10.6 and LibreSSL 4.4.0—bringing enhanced checks for untrusted inputs and revised connection-handling mechanics. Release notes reveal fixes for memory flaws, unsafe file handling, and weak process isolation affecting multiple services and firmware.
SSH gets post-quantum signatures and tighter restrictions
OpenSSH 10.6 introduces experimental support for a composite signature scheme combining ML-DSA 44 with Ed25519. Its identifier has shifted from an OpenSSH-specific label to an IANA codepoint, which means sysadmins testing earlier versions should verify compatibility. This update builds on the post-quantum key exchange changes rolled out in OpenSSH 10.0—where hybrid ML-KEM and X25519 became default. Also notable is the disabling of the LZ77 dictionary coder to block a potential side-channel attack.
Several security policies and configuration options have been tightened. Enforcement has been improved for ChannelTimeout and RekeyLimit settings; and the “restrict” attribute in authorized_keys now applies to tunnel forwarding. DisableForwarding is now more authoritative, taking precedence over PermitTunnel. Other fixes include eliminating client memory faults, preventing over-expansion in compressed data, validating server state both before and after authentication, and reducing the pre-login attack surface by removing vulnerable key parsing paths.
Broad system hardening & service fixes
Memory randomization on amd64 systems has been enhanced by randomizing the kernel’s direct memory map location. Kernel stack leaks have been plugged, and an unprivileged memory access vulnerability in the m88k 88100 pipeline has been removed.
Network services get numerous fixes: the PF firewall now resists out-of-bounds reads, race conditions in connection counting, and attacks leveraging crafted reset packets. httpd has been updated to reject ambiguous request framing and obsolete, folded headers. Relayd drops duplicate Content-Length headers and adjusts chunked message handling, while firmware updates now verify signatures, constrain download sizes, and prevent extraction of archives outside expected paths. Package installers no longer default to searching the current directory, and pax now blocks archive attacks that escape the working directory. In LibreSSL 4.4.0, X25519MLKEM768 becomes the preferred TLS 1.3 group, alongside fixes for certificate validation, OCSP responder bypasses, and excessive DTLS handshake buffering.
Administrators are encouraged to review compatibility changes, consult upgrade documentation, and verify release errata before deploying OpenBSD 8.0 in production environments.
Why this matters:OpenBSD has long been respected for its security-first stance, minimal attack surface, and rigorous development practices. With threats from quantum computing on the horizon, adding post-quantum signature support underscores where the OS is heading. This is not just about new cryptography—it’s about raising the baseline of security across many services and components.
