Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).

The paper studies the adoption of the pledge(2) and unveil(2) in the OpenBSD base system and packages over time, and finds that the features provided actually seem to facilitate adoption of secure coding practices.

The paper's abstracts concludes,

All in all, the measurement results indicate that the adoption of system call minimization and sandboxing techniques is not necessarily as troublesome as has often been discussed in the literature.

The full text of the paper is available too, as PDF, HTML, or TeX source, for your advocacy use and pleasure.

The OpenSSH project has released OpenSSH 10.4.

From the Release Notes:

Both relayd(8) and httpd(8) now have the "secure" list of allowed crypto methods for HTTPS, which include TLSv1.3 and the TLSv1.2 AEAD cipher suites. The previous list was "HIGH:!aNULL" which contain non-perfect-forward-security methods and this change may cause old clients to not be able to connect.

We almost missed this in a flurry of commits by Jonathan gray (jsg@), but following this commit, OpenBSD/amd64 kernels now have a 512GB address space.

The commit message innocently reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Jonathan Gray <jsg () cvs ! openbsd ! org>
Date:       2026-06-22 0:27:33
Message-ID: 162f075352ec66cd () cvs ! openbsd ! org

CVSROOT:	/cvs
Module name:	src
Changes by:	jsg@cvs.openbsd.org	2026/06/21 18:27:33

Modified files:
	sys/arch/amd64/include: vmparam.h 

Log message:
raise the size of amd64 kernel virtual address space from 4G to 512G

In OpenBSD, the syslogd(8) system logger has already for a while now fork(2)ed the privileged from the non-privileged parts.

Now Alexander Bluhm (bluhm@) decided it's time to split these parts into separate binaries in order to provide even better separation. The final commit message reads,

List:       openbsd-cvs
Subject:    CVS: cvs.openbsd.org: src
From:       Alexander Bluhm <bluhm () openbsd ! org>
Date:       2026-06-11 15:41:33

CVSROOT:	/cvs
Module name:	src
Changes by:	bluhm@cvs.openbsd.org	2026/06/11 09:41:33

Modified files:
	usr.sbin/syslogd: Makefile privsep.c syslogd.c syslogd.h 
	etc/rc.d       : syslogd 
Added files:
	usr.sbin/syslogd: Makefile.inc parent.c 
	usr.sbin/syslogd/parent: Makefile 
	usr.sbin/syslogd/syslogd: Makefile 

Log message:
Provide a separate executable file for syslogd parent.

Random order relinking of critical components is an OpenBSD feature specifically designed to make it harder to exploit bugs in the resulting binary. sshd(8) was the first of the network-facing daemons to get the random treatment (see this previous report).

Now in a series of commits that split one daemon (smptd(8)) into six separate binaries, Theo de Raadt (deraadt@) is bringing httpd(8) and smptd(8), both common in network facing configrations, into the random relink at boot fold.

httpd(8) was the first of the two:

In -current, Robert Nagy (robert@) updated clang(1), llvm, and lld(1) to version 22.1.6:
https://marc.info/?l=openbsd-cvs&m=178005264089753&w=2
https://marc.info/?l=openbsd-cvs&m=178005271889792&w=2
https://marc.info/?l=openbsd-cvs&m=178005276789832&w=2

Yes, that's a lot of churn, all for the better we think.

Work on ports compliance continues.

The LibreSSL project has announced the release of version 4.3.2 of the software.

The release notes are as follows:

Version 0.126 of Game of Trees has been released (and the port updated). Complete release notes are as follows: