Theo de Raadt (deraadt@) has committed to -current a (WIP) new utility for updating system databases:

CVSROOT:	/cvs
Module name:	src
Changes by:	deraadt@cvs.openbsd.org	2026/10/20 19:08:58

Added files:
	usr.sbin/dbupdate: Makefile dbupdate.8 dbupdate.sh 

Log message:
initial draft of dbupdate(8) for updating (signed) zoneinfo and cert.pem
from a new cdn.openbsd.org/pub/OpenBSD/dbupdates/ directory.  We can't
do this nicely with syspatch(8) because it requires patches in sequence
so a new tool had to be written.  It is intentionally kept very simple
so that it can be studied because we intend to run this in root cron,
(the non-simple parts figure out quickly when not to update).
looked at by sthen beck lucas dgl

The OpenBSD project has announced OpenBSD 8.0, its 61^st release.

The new release contains a number of significant improvements, including but certainly not limited to:

• OpenBSD/amd64 kernel virtual address space is now 512GB [See earlier report]
• Mitigation for AMD Zen-2 operation cache corruption added [See commit]
• OpenBSD now uses AES instructions (on amd64 and arm64 when available) to increase speed of swap encryption/decryption [See commit]
• The OpenBSD/loongson hardware platform has been retired [See earlier report]
• getexecpath(3) added [See commit]
• drm(4) has been updated to Linux 6.18.53
• vmm(4)/vmd(8) improvements:
  • files are now used to manage VM ownership [See earlier report]
  • multi-processor VMs are now supported [See earlier report]
• WPA3 support introduced [See earlier report]
• syslogd(8) privileged and non-privileged parts now separate binaries [See earlier report]
• qwz(4) driver for Qualcomm Technologies WCN7850 wireless network devices added [See commit]
• PF queues break the 4 Gbps barrier [See earlier report]
• httpd(8) and smtpd(8) are now randomly relinked at boot [See earlier report]
• httpd(8) has seen many improvements:
  • support for custom HTTP headers [See earlier reports]
  • header block/drop rules for request filtering [See earlier report]
  • improved default crypto methods for HTTPS [See earlier report]
  • cache control for static files [See commit]
• relayd(8) has received several improvements:
  • improved default crypto methods for HTTPS [See earlier report]
  • support for ECDSA keys and certificates was added [See earlier report]
  • filter rules gained support for Lua patterns(7) [See earlier report]
  • support for multiple resolvable addresses [See commit]
• rtrd(8), a RTR-To-Router protocol daemon, and its control program, rtrctl(8), were imported [See earlier report]
• acme-client(1) gained support for external account binding [See commit]
• Several improvements in OpenBGPD [See earlier reports]
• A number of incremental improvements in rpki-client(8) [See earlier reports]
• tmux(1) gained support for floating panes [See commit]
• LibreSSL 4.4.0 [See earlier reports]
• OpenSSH 10.6 [See earlier reports]
• llvm/clang(1)/lld(1) updated to version 22.1.6 [See earlier report]
• LLVM toolchain added to OpenBSD/sparc64 [See earlier report]
• compiler-rt, libunwind, libcxxabi, libcxx updated to version 22.1.8

In addition, this release offers a number of bug fixes and as well as numerous improvements in hardware support.

See the full changelog for more details of the changes made over this latest six month development cycle.

The Installation Guide details how to get the system up and running with a fresh install, while those who already run earlier releases should follow the Upgrade Guide, in most cases using sysupgrade(8).

Readers are encouraged to celebrate the new release by donating to the project to support further development of our favourite OS!

Version 0.130 of Game of Trees has been released (and the port updated).

Complete release notes are as follows:

In a post to tech@, Jan Schreiber submitted a driver for USB network control mode, uncm(4). Jan writes:

I noticed newer Android devices (since Android 6 if I'm not mistaken)
do not use urndis(4) for USB tethering any more.
They now use CDC NCM which is missing a driver in OpenBSD.

Below is my first go at it.
I moved some defines and structs out of mbim.h into usbcdc.h
to not include everything for mobile broadband. (No functional change
for umb(4)).

We have to admit that even users of a well rounded operating system like OpenBSD sometimes encounter hardware that is not quite supported yet.

Fortunately, sometimes the user facing the problematic hardware is an experienced developer like Ian Darwin, and he took the time to write up his experience in a blog post titled Un-hanging the HP Envy 17-DA0013dx for OpenBSD.

The article leads in with,

I recently acquired a lightly-used HP Envy 17" laptop, model DA0013dx, and of course wanted to run OpenBSD on it. It came with Windows 11 on an internal NVME drive. Booting OpenBSD from a USB device failed fast: it hung. To get there, first of course I had to disable "secure boot" in the BIOS.

and chronicles the steps until he reaches the conclusion,

Last words

If you want a modern laptop with a 16:9 touchscreen display to run OpenBSD, the HP Envy is not a bad choice.

If this sounds good to you, go on read the whole thing!

In their usual, unassuming fashion, the OpenSSH project have released a new version, release 10.6.

The full text of the 10.6 release nodes reads:

OpenSSH 10.6 was released on 2026-10-06. It is available from the
mirrors listed at https://www.openssh.com/.

OpenSSH is a 100% complete SSH protocol 2.0 implementation and
includes sftp client and server support.

Recently the OpenSSH team have received a large number of security
bug reports, many of which are findings from AI models or made with
AI assistance. While many AI reports are determined not to have
security impact when considered in the context of a realistic
threat model, we very much welcome these reports, especially when
combined with human triage, analysis, test-cases and particularly
when accompanied by proposed fixes.

In a move that hints strongly that the new OpenBSD release is about to drop soon, the LibreSSL project have announced the new stable releases.

The announcement reads,

List:       openbsd-announce
Subject:    LibreSSL 4.2.2 and 4.3.3 released
From:       Brent Cook <busterb () gmail ! com>
Date:       2026-10-06 0:38:40

We have released LibreSSL 4.3.3 and 4.2.2, which are available in the
LibreSSL directory of your local OpenBSD mirror.

As previously noted, Rafael Sadowski (radowski@) has been behind a recent pickup in development of httpd(8) and relayd(8).

Now Rafael has written a new piece, entitled Headers Up! What's New in httpd and relayd, on some of his recent work on httpd(8) and relayd(8).

Among the notable additions are expanded and improved filtering and pattern matching features which make it harder to make a case for putting something like nginx in front of your httpd(8) and relayd(8) setups.

So while we at Undeadly were making notes with a view to reporting on all these features, Rafael himself beat us to it.

His latest article is well worth reading, here.

In another hint that a new OpenBSD release is close, the OpenBGPD project has announced a new release of its software, version 9.3:

We have released OpenBGPD 9.3, which will be arriving in the
OpenBGPD directory of your local OpenBSD mirror soon.

This release includes the following changes to the previous release:

    * Add shorthand for well-known "DOWNGRADE" BGP community.

    * Remove support old aspa-set table format that included per-provider AFI.
      Rpki-client stopped issuing those with the 8.5 release in July 2023.

    * Use getexecpath in the fork-and-execute privilege separation setup
      and implement portable shims for various other operating systems.

    * Various minor fixes:
       - Improve graceful restart timer handling for multi-AFI/SAFI sessions.
       - Clear the connected nexthop flag when nexthops and nexthops are
	 no longer connected.
       - Fix edge case where an ASPA table update was not applied because the
	 system erroneously thought the table did not change.

OpenBGPD-portable is known to compile and run on FreeBSD and the
Linux distributions Alpine, Debian, Fedora, RHEL/CentOS and Ubuntu.
It is our hope that packagers take interest and help adapt OpenBGPD-portable
to more distributions.

We welcome feedback and improvements from the broader community.
Thanks to all of the contributors who helped make this release
possible.