OpenBSD 8.0 Released With Major Security Hardening and Post-Quantum SSH Support

OpenBSD 8.0 has been released with security fixes across its kernel, network services, firewall, and update tools, alongside experimental post-quantum SSH signature support.

Released on October 20, 2026, the project’s 61st release includes OpenSSH 10.6 and LibreSSL 4.4.0, bringing stronger checks for untrusted data and changes to secure connection handling.

The official release notes detail changes that address memory errors, unsafe file handling, and gaps in process isolation. For administrators, the update reaches beyond remote login security, covering web servers, mail delivery, DHCP services, virtual machines, and firmware installation.

OpenSSH 10.6 includes experimental support for the composite mldsa44-ed25519 signature scheme, which combines ML-DSA 44 with Ed25519.

The release also switches the scheme’s identifier from its OpenSSH-specific name to an IANA-allocated codepoint, a change that administrators testing earlier implementations should review.

OpenBSD 8.0 Released

This work concerns digital signatures rather than the initial introduction of post-quantum key exchange. As covered in OpenSSH 10.0’s security changes, that earlier release made hybrid ML-KEM and X25519 key agreement the default.

OpenBSD 8.0 therefore builds on existing quantum-resistant connection protection rather than introducing it.mSSH hardening also includes turning off the LZ77 dictionary coder to avoid a potential side-channel leak.

Developers corrected enforcement of ChannelTimeout and RekeyLimit settings and ensured the authorized_keys “restrict” option applies to tunnel forwarding. DisableForwarding now overrides PermitTunnel, tightening control over remote access features.

Additional fixes address client memory errors, excessive expansion of compressed data, and validation of state passed between SSH server processes before and after authentication. Some key parsing and verification paths were also removed from the code exposed before login.

On amd64 systems, OpenBSD now places the kernel’s direct memory map at a random location. The release also fixes kernel stack information leaks and removes an unprivileged kernel memory read and write vulnerability affecting the m88k 88100 data pipeline.

These changes extend the security focus described in OpenBSD 7.7’s release coverage. Version 8.0 adds tighter pledge socket checks and limits file access for manual-page tools through unveil.

The PF firewall receives fixes for out-of-bounds reads, connection counter races, and crafted reset packets that could incorrectly remove TCP state. Meanwhile, httpd rejects ambiguous request framing and obsolete folded headers.

Relayd rejects duplicate Content-Length headers and removes Content-Length from chunked messages, reducing differences in how HTTP requests are handled.

Firmware updates now verify signatures on local SHA256.sig files, restrict download sizes, and skip archive entries outside expected locations. Package installation no longer searches the current directory by default. At the same time, pax blocks malicious archives from extracting files outside the working directory.

LibreSSL 4.4.0 makes X25519MLKEM768 the preferred TLS 1.3 group in libtls. It also fixes certificate checks, an OCSP responder authorization bypass, and excessive DTLS handshake buffering.

Administrators should review compatibility changes, consult the linked upgrade documentation, and check release errata before deploying the update across production systems.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post OpenBSD 8.0 Released With Major Security Hardening and Post-Quantum SSH Support appeared first on Cyber Security News.