------------------------------------------------------------------------ - OpenBSD 8.0 RELEASED ------------------------------------------------- October 20, 2026. We are pleased to announce the official release of OpenBSD 8.0. This is our 61st release. We remain proud of OpenBSD's record of more than thirty years with only two remote holes in the default install. As in our previous releases, 8.0 provides significant improvements, including new features, in nearly all areas of the system: - Platforms specific improvements: o amd64: - Raised the size of amd64 kernel virtual address space from 4G to 512G. - pmap(9) direct map now placed at a random location. - Sped up swap encryption by using AES cpu instructions. o arm64: - Added hibernate support. - Sped up swap encryption by using AES cpu instructions. - Implemented bounce buffers. o luna88k: - Fixed m88k multiple CMMU register writes. - Extended m88k kernel-mode CMMU fault handling to handle write protection faults. - Ensure luna88k m8820x_initialize_cpu() initializes logical CPU #0 on non-MP kernels. - Faster CMMU walk in luna88k m8820x_cpu_number(). o riscv64: - Detect CPU extensions and advertise those usable by userland through elf_aux_info(3) AT_HWCAP and AT_HWCAP2 queries. - Added kernel support for the 'V' vector extension. - Implemented bounce buffers. - Added support for RISC-V Advanced Interrupt Architecture; added imsic(4) and aplic(4) drivers. - Added kernel support for the Sstc timer extension. o sparc64: - Added bounds check for the sparc64 relocation flags table. - Switched sparc64 to LLVM toolchain. - Improved memory alignment on SPARCV9. o Other architectures: - Retired support for loongson architecture (not working with Clang 22). - Various RISC-V and MIPS bugfixes for LLVM. - Fixed encoding of hppa protection bits. o More platform specific changes can be found in the hardware support section below. - Various kernel improvements: o Fixed memory size calculation in open_wmemstream(3). o Fixed semop(2) semaphore id being destroyed/replaced during context switch. o Improved inactive page queue heuristics for pagedaemon swapping pages/freeing memory. o Added getexecpath(3) to provide copy of the elf(5) program's execution path. o More preparations for larger disklabel. - Suspend/Hibernate Support: o Enabled suspend/resume for qwz(4). o Made ufshci(4) survive a suspend on the Samsung Galaxy Book4 Edge and HONOR MagicBook Art 14 Snapdragon. o Stopped waking a suspended laptop when lid is closed and machdep.lidaction=0. o Added a global sleep mode variable to distinguish hibernate from 'normal' suspend. o Added suspend/resume support for qcuart(4). o Added support for wakeup interrupts to bytgpio(4), fixes IdeaPad resuming from suspend. o Validate size of chunks copied to piglet during hibernate unpacking of disk image. o Validate on-disk image sizes against integer overflow when reading chunks in unhibernate. o Prevent disk image overreads when reading the chunktable in unhibernate. o Clean up the framebuffer after unhibernate. o Made failure to allocate a dedicated queue for nvme(4) hibernate support non-fatal. - Direct Rendering Manager and graphics drivers: o Updated drm(4) to Linux 6.18.53. o Support for Intel Arc A-Series (DG2/Alchemist) graphics cards in inteldrm(4). o Increased kernel virtual address space on amd64 allows mapping more than 4GB of VRAM. o Workaround inteldrm(4) GuC timeout errors seen on some Alder Lake systems. - VMM/VMD improvements: o Added MP support for up to 64 VCPUs per guest VM. o Redesigned to use files to manage VM ownership. o Added x2apic mode support for guest virtual machines. o Fix for when vmd(8) does not detect kernel on startup. o Provide faulting GPA to vmd(8) for MMIO exits from vmm(4). o Refactored vmm(4) exit handling and correct RIP adjustment. o Added support for variable length instructions in VMX paths to vmm(4). o Prevent OOB reads by vmd(8) in 32 and 64-bit elf(5) loaders with malformed elf(5) files. o Implemented missing lapic/ioapic modes to fix vmd(8) support for 32-bit linux guests. o Added checksum offload for vmd(8) guests. o MSI/MSI-X virtio device interrupt support added. o Support actually split split-virtqueues in vmd(8). o Added i82093aa ioapic and i82489dx-compatible lapic emulation to vmd(8). o Improved qcow handling. - Various new userland features: o netstat(1) can now print interface multicast counter; made '-q' more specific. o Adjusted ddb(4) default 'ps' output, print 'struct process' and 'struct proc' separately. o Made mount(8) support DUIDs with -u; preserve DUID when updating file system. o Implemented control of midithru ports with sndioctl(1). o Allow list elements to be added or removed by sndioctl(1). o Added the sndiod(8) server.mode control making the setting dynamic, changeable via sndioctl(1). - More bugfixes and tweaks in userland: o Ensure elf(5) header and program header fit into the shared library when loading. o Fixed leak of key memory in getpwent(3) yp_next(). o In patch(1), solved an infinite loop on malformed ed(1) script input. o Use execv(3) absolute-path in authpf(8), pflogd(8), ldapd(8), ldpd(8), lpd(8), radiusd(8), snmpd(8). o uaudio(4) now tests the reported format and channels are usable. o Stopped sndiod(8) aborting if a MIDI endpoint connects with non-empty buffers. o Fixed two missing checks of file_new() return value in sndiod(8). o Fixed npppd(8) LCP MRU option handing. o Adjust pstat(8) to return the pid of the session leader process; allow '-t -M' to work. o Made eigrpd(8) validate the prefixlen to avoid overflow. o Made sndiod(8) allocate all midithru structures on the heap. - Improved hardware support and driver bugfixes, including: o Enabled the GXTP7936 touchscreen on the Samsung Galaxy Book4 Edge. o Added support for the riscv64 K3 PCIe/USB3 combo PHY. o Enabled gpioleds(4) on riscv64. o In smte(4) (SpacemiT K1 Ethernet device), improved error checking of received packets. o Fixed regular MSI interrupts on the SpacemiT K1 SoC. o Added support for the SpacemiT K3 SoC to smtclock(4). o Added SC7280 support to qcgpio(4). o Added support for the SpacemiT K3 dwpcie(4) PCIe controller. o Added RK3528 I2C5 clock, used in the Radxa E24C. o Added ACPI hardware IDS for Qualcomm Glymur (X2) SoC. o Implemented page table mirroring in apldart(4); enable IOMMU for Apple USB controllers. o New samsabi(4) driver for the Samsung Advanced BIOS Interface (SABI). o New sambat(4) driver for Samsung laptop battery monitor. o New rkotp(4) driver for Rockchip OTP memory. o Added support for the RK8600 regulator used for CPU voltage on Radxa Zero 3 boards. o Added more AMD "Krackan Point" device ids. o Fixed HONOR MagicBook Touchpad multitouch support. o Fixed esp(4) FIFO memory overflow. o Fixed potential memory leak in softraid(4) rebuild. o Fixed softraid(4) rebuild on disks with 4096-byte sectors. o Fixed high memory mbufs for 64-bit DMA capable re(4). - New or improved network hardware support: o Added support for Panther Lake and Wildcat Lake Ethernet devices to em(4). o Added support for Intel E610 Ethernet devices to the ix(4) driver. - Added or improved wireless network drivers: o Properly handle potential case of empty packets returned from qwx(4) hardware. o Added missing DMA syncs for qwx(4) SRNG DMA descriptor memory. o Properly handle qwx(4) VIF DMA map allocation failures at attach time. o Fixed use of stale pointers on the qwx(4) vif list which caused crashes. o Properly reset qwx(4) driver and device state if it fails to get RUNNING in qwx_init(). o Avoid race condition in qwx(4) device during power-on. o Use the ioctl rwlock correctly in qwx(4) qwx_activate(). o Ensure qwx(4) rx_ring->bufs_max and freemap are always initialised correctly. o Stopped qwx(4) init task waiting for the ioctl lock to become available. o Made qwx(4) properly errors which occur in qwx_qmi_fw_init_done(). o Fixed roaming between APs with qwx(4). o Always allow data frame interrupts in qwx(4) while the interface is UP. o Added support for 40MHz channels to qwx(4). o Made qwx(4) only allocate a new mbuf when a free Rx ring slot is available. o Avoid calling bus_dmamap_create() from interrupt context in qwx(4). o Handle country code events sent by qwx(4) firmware to make association more reliable. o Reset qwx(4) command ring 'queued' counter when the command ring gets reset. o Ensure that qwx(4) nq flags are always cleared when switching net80211 state. o Fixed number of tx/rx streams set in qwx(4) mac config. o Made qwx(4) send the PMF good-bye deauth frame when hopping out of RUN state. o Ensure no new tasks get scheduled while IFF_RUNNING is in qwx_stop(). Prevents qwz(4) crash. o Make qwx(4) prefer ic_bss over the ephemeral node in the scan tree. o Add peer to qwx(4) firmware after starting the vdev, not before. Fixes a firmware crash. o Add 802.11n support to qwx(4). Advertise HT capabilities and pass HT/QoS peer association. o Ask qwx(4) firmware to move into M3 state before resetting the device. o Avoid calling bus_dmamap_destroy() from interrupt context in qwx(4). o Added 802.11n with 40MHz width to qwz(4). o Let qwz(4) handle QoS in native WiFi frames. - Installer, upgrade, bootloader, and pkg-tools improvements: o Harmonise installurl(5) handling in pkg_add(1), sysupgrade(8), and syspatch(8). o Fixed free space check by fw_update(8) for unqualified filenames. o Set limit on the size of files fw_update(8) can download. o Stricter validation in fw_update(8) to no longer treat untrusted comments as data. o pkg_add(1) now detects and overcomes some endless loops with merge-sets. o Clean trailing slashes from fw_update(8) FWURL. o Removed current directory from default pkg_add(1) search path. o Improved downloading of firmware by filename in fw_update(8). o Improved fw_update(8) error when SHA256.sig is not found. o fw_update(8) now checks signature of local SHA256.sig. o In fw_update(8), made tar(1) skip files outside expected locations. o Stopped syspatch(8) downloading entire tgz file when looking for a potential update. - Security improvements: o Fixed a pledge(2) in vfs(9). o Fixed out-of-bounds access attempts on aplmca(4) SOCs. o Stopped use of non-standard UID_MAX and GID_MAX in various utilities. o Improved ipsec(4) AES GMAC crypto. o Made iked(8) reject malformed and out-of-state IKEv2 messages. o Plugged memleak in x509_verify (CID 656293). o Avoid overflow in sysctl(2) KERN_PROC_ARGS. o Prevent bogus or malicious iaddr data from crashing dhcpd(8). o Avoid potential memory exhaustion via DHCPINFORM in dhcpd(8). o Properly use saltlen and min_saltlen in libcrypto RSA-PSS. o Reject invalid delta CRLs in libcrypto x509. o Fixed RFC 3779 inheritance handling in libcrypto's path validation. o Use execve(2) as $ORIGIN in ld.so(1) (otherwise fallback to realpath). o Hardened syspatch(8) against malicious scripts. o Restrict the characters that are allowed to pass through smtpd(8) environment and mda. o Fixed reading past the NUL by pax(1). o Stopped pax(1) extracting malicious archives outside the working directory. o Added 'mcast' to the pledge(2) for lldpd(8). o Tightened pledge_sockopt() level/optname checks for different types of sockets. o Extended the 'mcast' pledge(2) to allow multicast tweaks on Ethernet frame sockets. o Updated libexpat to version 2.8.4 (CVE-2026-66046 CVE-2026-76641 CVE-2026-76957). o Avoid script pathname TOCTOU in exec when the vnode changes. o Made execve(2) realpath processing more robust. o Switched luna88k to build kernel files with -fno-pie. o Unprivileged kernel memory read and write vulnerability removed from m88k 88100 data pipeline. o unveil(2) now restricts man(1), makewhatis(8), and man.cgi(8) read and write access. o dhcpleased(8) now validates the IP address the dhcp server acks. o Fixed signed integer overflow in perl(1) Storable (CVE-2026-57433). o Fixed integer overflow in perl(1) pack and unpack (CVE-2026-57432). o Fixed perl(1) incorrect regular expression matches (CVE-2026-13221). o Fixed memory leaks and race condition in profil(2). o Improved checking of elf(3) notes; prevent out of bounds access. o Reject elf(3) interpreters without loadable segments. o Disable kbind(2) and pinsyscalls(2) for static binaries inside exec_elf_makecmds(). o Fixed elf(5) structs to avoid leaking kernel stack contents. o LibXfont 2 fixes for CVE-2026-56001, CVE-2026-56002, and CVE-2026-56003. o Xserver(1) fixes for CVE-2026-55999 and CVE-2026-56000. o Updated perl(1) Socket to 2.041 (contains fix for CVE-2026-12087, out-of-bounds heap read). o Fixed iked(8) to bzero(3) the mask data structure, rather than using mask4. o Fixes for CVE-2026-12244, CVE-2026-12245, CVE-2026-12246 and CVE-2026-12490 in nsd(8). o Stopped leaking transport in isakmpd(8) error paths of udp_encap_handle_message(). o Enforce per-type ID payload size in isakmpd(8) ipsec_validate_id_information(). o Avoid shift overflows in memmem(3) and strstr(3). o Multiple additional bounds checks in isakmpd(8). o Provide a separate executable file for syslogd(8) parent, for privilege separation. o Made smtpd(8) clear userinfo before sending over imsg. o Made smtpd(8) reject oversized sockaddr payloads received over privsep IPC. o Zero the temporary smtpd(8) envelope parsing buffers before use to strengthen privsep. o Clear pending asynchronous lookups at teardown, for stronger smtpd(8) privsep. o Fixed potential information leak from an uninitialised ktrace(1) stack variable. - New features in the network stack: o Set ice(4) link state to full duplex. o Reduced maximum TSO segs in ice(4), to allow more interfaces to attach. o Enabled use of 128 DMA segments for TSO packets on ice(4). o Enabled 64-bit DMA for bge(4) BCM5720. o Enabled jumbo frames in ogx(4). - Further changes and bugfixes in the network stack: o Stopped ipsec(4) overflowing the maximum packet size in the IP header. o Detect out of bound reads from an int overflow in the bpf(4) bpf_mem backends. o Moved bpf(4) for outgoing packets later in the transmit path. o Avoid leaking memory when mbuf chain allocations fail in tun(4) tun_dev_write(). o Fixed hardmtu and rxmax in ixl(4). o Handle dynamic channel width changes correctly in iwx(4). o Hardened bpf(4) bpf_filter; block unhandled instructions with bpf_validate. o Added proper program bound checks to the bpf(4) engine (libpcap CVE-2026-31912). o Fixed bpf filter calls in ppp(4); use bpf_mfilter(9). o Improved imsg handling of LS_UPD, LS_FLOOD and LS_SNAP in ospfd(8). o Changed ospfd(8) imsg handling. o ospfd(8) now adds missing rtlabel references and update routes when only the label changes. o Preserve configured interface type on ospf6d(8) link update. o Ensure ospfd(8) does not leak information on memory address layout from process. o Made authpf(8) read_config() remove trailing white space to avoid misconfigurations. o Fixed veb(4) SIOCBRDGRTS and SIOCBRDGVRTS ioctls leaking kernel stack data. o Fixed packet corruption in veb(4). o veb(4) now returns ENOMEM when mallocarray() fails in veb_rule_list_get(). o Fixed ifconfig(8) 'vebX -tagged ifX' which accepted too many arguments. o Improved em(4) K1 exit timeout, to receive non-broadcast packets. o Simplified mac type tests on em(4). - The following changes were made to the pf(4) firewall: o Fixed off-by-one in pf(4) ioctl DIOCIGETIFACES. o Do not free the pf(4) caller's ruleset when attaching a table fails. o No longer allow un-terminated strings in pf(4) ioctl's. o Stopped pf(4) dropping valid MLD packets with unspecified source address. o Prevent pf(4) dropping TCP state if it receives a crafted reset packet. o Fixed races in pf(4) connection counters that caused connection counter underflows. o Fragment reassembly in pf(4)/inet(4)/inet6(4) now occurs in correct routing domain. o Stopped 'pfctl -s all' dumping all OS fingerprints loaded to pf(4). o Fixed NULL pointer dereference in pf(4) outbound packet path. o Fixed out-of-bounds read in pf(4) pf_rule_copyin(). - Routing daemons and other userland network programs saw the following improvements: o Altered smtpd(8) code to avoid false bug reports from LLM scanners. o Prevent size_t underflow on a malformed packets in agentx(3) and snmpd(8). o Widen httpd(8) server flags to 64-bit integers. o httpd(8) now enforces 'max request body' for chunked requests passed to fastcgi. o Made httpd(8) reject config of shared TLS listeners with different client CA or CRL. o In httpd(8) now sends one imsg fastcgi param struct per parameter, to preserve config order. o Added custom HTTP header support to httpd(8). o Fixed httpd(8) suffix range handling. o Stopped httpd(8) sending location fcgiparams twice. o Made httpd(8) drain abort response via bufferevent to prevent errors being truncated. o Restricted IMSG_CTL_PROCFD to parent and check process id/instance in iked(8), httpd(8), relayd(8), and snmpd(8). o Switched the default TLS cipher in httpd.conf(5) set from 'compat' to 'secure.' o Made httpd(8) and dhcpd(8) correctly error check timegm(3). o Random-relink smtpd(8) and httpd(8) at boot. o httpd(8) now rejects CL.TE request framing (per RFC 9112 sections 6.1 and 6.3). o Made httpd(8) reject obs-fold with 400 (RFC 9112 5.2). o Fixed uploads using httpd(8) chunked transfer-encoding. o httpd(8) will now advertise Vary: Accept-Encoding whenever gzip-static is enabled. o Made httpd(8) advertise static file revalidation, preserving Last-Modified and If-Modified-Since flow. o Added more config checks to relayd(8). o Explicitly flush relayd(8) redirect rules after reloading. o In relayd(8), removed wrong disable flag for routers. o Use a per-host random ICMP echo id in relayd(8). o Added Lua patterns(7) support for relayd(8) filter rules; improved glob(7) documentation. o Use getexecpath(3) and execv(3) in bgpd(8) eigrpd(8), httpd(8), iked(8), ntpd(8), relayd(8), and smtpd(8). o Fixed relayd(8) deferring connections log. o Made relayd(8) check proc_compose and imsg_compose_event return values. o Allow setting log level from relayd.conf(5). o Added ECDSA support to the relayd(8) CA privsep engine. o relayd(8) now rejects duplicate Content-Length headers with 400. o Switched the default TLS cipher in relayd.conf(5) set from 'HIGH:!aNULL' to 'secure.' o Switched relayd(8) to new imsg API. o Made relayd(8) strip Content-Length for chunked messages (RFC 9112 section 6.1). o Made relayd(8) reject obs-fold to prevent parser differentials (RFC 9112 5.2). o Removed relayd(8) X509_dup() call that leaks memory; add error checks for X509_set_*. o In relayd(8), added support for the MKCALENDAR HTTP method. o Fixed debug build of relayd(8). o Let relayd(8) support multiple resolvable addresses. o Let relayd(8) handle HTTP responses without bodies. o Fixed NULL dereference in isakmpd(8) message_alloc_reply() callers. o Fixed possible unaligned 32-bit read by isakmpd(8). o Validate isakmpd(8) DELETE payload SPI array size. o Validate proposal and transform sizes in isakmpd(8). o Added length checks for the Port-Message and State attributes in login_radius(8) Access-Challenge. o Prevent the dhcpleased(8) engine from sending us a negative amount of routes. o Made dhcpleased(8) accept correct amount of routes from the engine process. o Make sure dhcpleased(8) UDP header length field at least covers the UDP header. o Extended smtpd(8) mask-src to suppress session details. o Switched smtpd(8) over to imsgbuf_get(3). o Free dispatcher in smtpd(8) mda_envelope_free() to avoid a leak. o smtpd(8) now rejects empty or slash-bearing usernames before building the mbox path. o smtpd(8) now rejects CR/LF in argv-derived fields before starting the SMTP enqueue dialogue. o Properly free the copied envelope on the smtpd(8) smarthost lookup failure path. o Properly free mda_subaddress in smtpd(8) mda_envelope_free() to avoid memory leak. o Made smtpd(8) use inflateEnd() to tear down the inflate stream in uncompress_gzip_chunk(). o smtpd(8) now stops parsing DNS answers once unpack_rr() reports failure. o Validate encrypted smtpd(8) queue buffer sizes before processing auth tag and IV data. o Imported rtrd(8) RPKI-To-Router protocol daemon and rtrctl(8). o acme-client(1) saw several changes: - Allow wildcards to be specified in alternate names in the acme-client(1) config. - Made acme-client(1) wipe optarg/eab/eab_key with freezero(3) after use. - Error check strdup() for external account binding by acme-client(1). - In acme-client(1), prevent HTTP request injection. - Let acme-client(1) handle '=' padding in base64url encoded EAB keys. - Fixed timegm(3) invocations in acme-client(1). - Added support for acme-client(1) external account binding. o In bgpd(8): - Adjusted bgpd(8) graceful restart timer handling for multi-AFI/SAFI sessions. - Made bgpd(8) do a prefix re-evaluation if the validation state of a route changes. - Clear bgpd(8) NEXTHOP_CONNECTED in nexthop_update() if msg->connected is false. - Made bgpd(8) throttle reads from the peer when MSG_PROCESS_LIMIT reached. - Fixed bgpd(8) aspa_table_equal() equality comparison. - Incorporated new RTR v2 error codes from draft-ietf-sidrops-8210bis-26 to bgpd(8). - Reworked bgpd(8) IdleHoldTimer and how fast reconnects are implemented. - Reworked the force_update logic in the bgpd(8) adj-rib-out. - Stopped bgpd(8) leaking peer data to bgpctl(8). - Implemented ch_meta_locate() in bgpd(8). - Brought back the bgpd(8) path_id_tx hack for regular peers. - In bgpd(8), improved mrt_dump_entry_mp() calculation handling, avoid overflow. - Avoid infinite loop when parsing PFKEY replies in iked(8), isakmpd(8), bgpd(8), and ldpd(8). - Had bgpd(8) make sure the nexthop attribute is present if there is any nlri data. - Stopped bgpd(8) failing hard on version mismatch; ignore extra end-of-params messages. - Improved bgpd(8) handling of unknown extended communities. - Increased the bgpd(8) MRT attribute buffer to MAX_EXT_PKTSIZE so it works in all cases. - Fixed use-after-free in bgpd(8) rib_remove and parse.y. - Added bgpd(8) force_update flag to force pend_prefix_add() calls in adjout_prefix_update(). - Made bgpd(8) respect RTR min-version in downgrade path and properly closing the connection. - Improved bgpd(8) add-path send parser. Error out if max is used with best. - Adjusted handling of limits in bgpd(8) up_generate_addpath(). - Added extended message capability to checks for what the bgpd(8) peer has enabled. - Made bgpd(8) return an error on unhandled imsg types in the adj-rib-out case. - Fixed bgpd(8) port configuring on little endian systems. - Extra size checks for bgpd(8) ibuf_set_maxsize(). - Introduce MAX_ADDPATH_COUNT (set to 100) and use this for the bgpd(8) add-path. - In bgpd(8) merge_peers() also set local_bgpid for cloned peers, not only regular peers. - Loop counters converted from uint8_t to u_int in bgpd(8). - Reduce maximum configurable stale time to CAPA_GR_TIMEMASK (4095) in bgpd(8). - In bgpd(8) session_graceful_restart() also arm the SessionDown timer. - Made bgpd(8) check xp->rdesession to know if the RDE has the session running or not. - Improved path_calc_hash() in bgpd(8). - Fixed 'treat as withdraw' handling for invalid bgpd(8) ORIGIN attributes. - Fixed two memory accounting issues in bgpd(8) chash. - Additional checks on TLV encoding in bgpd(8). - Limit all bgpd(8) ASPATH attributes to 750 elements. - In bgpd(8), prevent overflow of the uint8_t length value in attr_optadd. - Re-evaluate bgpd(8) prefixes if just PREFIX_FLAG_FILTERED changed. o In rpki-client(8): - Fixed rpki-client(8) to avoid buffer overreads with OpenSSL 4.1. - In rpki-client(8), reject non-conformant certificate subject encodings. - Made rpki-client(8) check alignment of certificate CRLDPs with the referring Manifest. - Reworked rpki-client(8) cms_parse_validate(). - Fixed handling of inherited resources in leaves by rpki-client(8). - Unified all signed object parser functions in rpki-client(8). - rpki-client(8) now unconditionally warns about incorrect RSA parameters; rejects some malformed ROAs. - Limit the range of deltas added to the rpki-client(8) queue. - Ensure consistent states in persistent rpki-client(8) HTTP connections. - Removed behaviour difference between rpki-client(8) versions with and without gbr support. - Fixed possible exit race in the rpki-client(8) parser. - Made rpki-client(8) only record NCA history on successful runs. - rpki-client(8) will now only output config files on successful run. - Batch rpki-client(8) retries of non-functional CAs based on their rsync base URI. - Properly apply constraints to rpki-client(8) BGPsec Router certs. - Deduplicated rpki-client(8) skiplist, shortlist, and NCA retry handling. - Removed incorrect free in rpki-client(8) nca_hist_load(). - In rpki-client(8) cert_ca_sia(), use the correct notify string in error message. - Removed double fclose in a success path in rpki-client(8). - Added a coinflip to increase cycle-to-cycle jitter in rpki-client(8). - In rpki-client(8), added a backoff retry mechanism for non-functional CAs. - rpki-client(8) now rejects certs with duplicate extension OIDs. - Clear last_modified after each response on a persistent HTTP rpki-client(8) connection. - In rpki-client(8), switch subordinates in CCR manifests to a simple queue. - Made rpki-client(8) exclude hidden files and directories when synchronising via rsync. - In rpki-client(8), limited the length of filenames in some ASN.1 fields to 255. - Fixed incomplete strncmp() check in rpki-client(8). - Fix off-by-one in rpki-client(8) ip_addr_check_overlap(). - Fixed shortlist and skiplist checks in rpki-client(8). - Added more error checks and safeguards to rpki-client(8). - tmux(1) improvements and bug fixes: o Keep the scroll position in tree mode when the list is rebuilt (issue 5631). o Do not leak waiting clients (in wait-for) if they are killed (issue 5614). o Do not cancel mark when a click is on the border. o Added support for borderless menus, like panes. o Added utf8 terminal-features. o Ignore focus events earlier to avoid them interfering with prefix. o Added -K flag to new-pane to make a modal pane capture all keys. o Always unzoom before splitting windows, including for floating panes. o Added 'T' to change pane title. o Added refresh-now command. o Ignore Ms if it is invalid (eg no %p1), report in client mode. o Fixed crash when synchronising groups and there is no current window. o Added pane_private_modes format with list of DEC private modes. o Prevented core dumps upon startup on landisk. o Added modal panes, created currently with new-pane -O. o Major rework of prompts. o Fixed cursor calculation when the status line is at the top. o Added -H flag to capture-pane to show hyperlinks. o Added -L to show line numbers with capture-pane and -F to show line flags. o Clear entire lines when removing from history or freeing. o Redraw entire session when making a new pane. o Added -g flag to kill-session to kill all sessions in a group. o Fixed crash when freeing layout cell. o Added missing argument to %unlinked-window-renamed. o Increase escape delay if the buffer contains a partial paste end. o Fixed crash caused by including unattached clients on sorted list. o Added new-pane command. o Fixed infinite loop due to underflow when redrawing scrollbar. o Fixed control mode teardown ordering for queued pane output. o Added Emacs-style re-centre-top-bottom. o Added time limits to some loops. o Added missing flags to screen_mode_to_string. - LibreSSL version 4.4.0: o Portable changes: - Numerous compatibility layer fixes for AIX, FreeBSD, macOS, MinGW, NetBSD, and especially Windows. - Fixed incorrect code generation by the MSVC ARM64 optimizer in constant-time bignum code. - Improved assembly support on many platforms. - Fixed openssl(1), nc(1), and ocspcheck(8) silently running without pledge(2) and unveil(2) on hosts that provide them. o Internal improvements: - Minor code cleanup for PKCS#7. - Clear unused bits for the maximum of RFC 3779 IP address ranges. - Cleanup passes over the DTLS code, avoiding many contortions. - Zero out the failure_key in ML-KEM code. - Improve portability in preprocessor based SHA assembly. - Removed a few vestigial #ifdefs from public and internal headers. - Introduce and use dtls12_handshake_msg framework. - Rename union from _ to u in the ui code. Avoids Windows CE #ifdef. - Clean up and simplify signature algorithm handling after removal of TLSv1.0 and TLSv1.1. - Add a point at infinity check to ecdh_compute_key(). - Fix incorrect purpose check in unreachable non-legacy path of the modern X.509 verifier. - Improve TLSv1.3 server handling of no shared groups. - Correct secondary key share handling for HelloRetryRequests. - Fix EXFLAG_CRITICAL mishandling in the crl_cb(). - Among CRLs with the same score prefer the one with the most recent thisUpdate to match BoringSSL and OpenSSL behavior. - Clean up sequence number and message header handling in DTLS. - Remove redundant BIO_write() length assertions in b64_write(). - Report invalid base64 BIO state as an internal error rather than asserting. - Improve SHA-3 performance by using an unrolled and interleaved algorithm. - Allocate TLSv1.3 receive buffers lazily. - Simplify handling of remaining record content on switch to the legacy stack. - Avoid harmless narrowing of the return value in dtls1_ctrl(). - Remove NID_md5_sha1 support from tls1_PRF(). - Remove DTLS unprocessed records queue. - Remove DTLS application data queue. - Remove SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS which was never set. o Compatibility changes: - The misnamed tls_peer_cert_chain_pem() has been deprecated and may be removed in a future release. tls_peer_cert_chain_verified_pem() and tls_peer_cert_bundle_unverified_pem() should be used instead. - Use X25519MLKEM768 as the preferred group for TLSv1.3 connections in libtls. - Ensure libtls keeps working with future OpenSSL releases that will stop NUL-terminating ASN.1 strings. This is an old bug in libtls that will bite, probably starting with OpenSSL 4.2. - CRYPTO_cleanup_all_ex_data() is now a no-op. It was not thread safe and the actual cleanup is now done by OPENSSL_cleanup(3). - Align X509_check_ca(3) with modern OpenSSL. While it has long been documented that it only works after calling X509_check_purpose(3), it still makes sense to "fail closed", i.e., indicate a non-CA. - Added OIDs for CCR, ErikIndex, ErikPartition, ErikSegmentIndex, and communityDefinition. o Bug fixes: - Fix PKCS7_set_{un,}signed_attributes(3) to allow caller to free on failure rather than risking a double free. - Initialize decode_error and invalid_key variables in TLS key share code to avoid branching on uninitialized memory. - Record extension length between type and data in the ClientHello hash to ensure identical framing in first and second CH. - Fix out of bound writes in the s_client XMSS mode. - Ensure EC_GROUP_check(3) and X509_CRL_verify(3) failures result in "app" failures in openssl(1) ecparam and openssl crl. - Do not fail accept on reverse DNS lookup failures in s_socket. - Ensure X509V3_EXT_print(3) only returns 0 and 1. - Avoid calling memcmp() on NULL in IPAddressFamily_cmp(). - In libtls disallow wildcard matching of a TLD specified as a FQDN. - Unbreak some aspects of TLSv1.2 with custom curve lists. - Ensure a peer-provided EC public key uses uncompressed encoding. - Send decode_error alert on failure to decode an EC peer pubkey. - Avoid NULL dereference and out-of-bounds read in password-based CMS decryption. - Add some missing bounds check to ASN1_mbstrinc_copy(). - Avoid freeing a caller-owned buffer in PKCS7_verify(3). - Remove SSL_OP_LEGACY_SERVER_CONNECT from default options. - Send illegal parameter alerts for various HelloRetryRequest violations. - Check that the server selected ciphersuite is valid for use with TLSv1.2. - Unlock CRYPTO_LOCK_UI on ui_open_session() failure to avoid a deadlock. - Check HMAC(3) return value to avoid later use of uninitialized in openssl(1). - Use correct alert for key_share without supported_groups. - Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1. It has long been documented that this is ill advised but some applications still do it. - Ensure the server selects an ALPN protocol that we advertised or abort the handshake with illegal_parameter. - Fix streaming of PKCS#7 objects with omitted content. - Avoid OOB access due to type confusion in PKCS7_stream(). - Plug leak and various other bugs in asn1_multi(), a helper to handle sequences and sets in config parsing. - Fix RFC 3779 inheritance checks for leaves as far as possible without breaking the RPKI. Still allow the immediate issuer to omit one of the extensions because otherwise about one third of RFC 9286 Manifests would become invalid. - Correct a botched size check in dtls1_process_fragment(). - Avoid confusing delta CRLs as full CRLs. - When copying an RSA-PSS EVP_PKEY_CTX, ensure saltlen and minimal saltlen restrictions are copied rather than using the defaults. - Allow DTLS clients to receive unexpected Finished messages. - Cache the leaf's extensions before adding it to a validated chain to make name constraints check work more reliably. - Ensure the whole subject is searched for email addresses and common names. - Check for embedded NULs in emails and subjectAltname in the essentially unused legacy NAME_CONSTRAINTS_*() API. - Remove support for nameRelativeToCRLIssuer in the CRL Distribution Point extension. Per RFC 5280 it SHOULD not be used by conforming CAs and it was eating memory for breakfast pre-signature. o Security and reliability fixes: - Fix parsing issues in X.509 name constraints URI host parsing. Handle IPv6 literals correctly and don't allow specially crafted userinfo to bypass host checks. - Limit size of buffered DTLS handshake messages to avoid overly large memory consumption on small handshake message fragments. - Fix an OCSP responder authorization bypass for clients using tls_config_ocsp_require_stapling(), of which only OpenBSD nc(1) and ftp(1) are known when they're used with the "muststaple" key word. o Testing and proactive security: - Improved test coverage for DTLS and TLS renegotiation. - Add X.509 CRL regress from pre-Apache2-licensed BoringSSL. - Rework the testing framework to be memory based rather than file based. Match Go's output format more closely. - OpenSSH 10.6: o Security fixes: - Disabled ssh(1) LZ77 dictionary coder to avoid a potential side-channel leak. - Fixed ChannelTimeout and RekeyLimit not being applied in sshd_config(5). - Made ssh(1) authorized_keys "restrict" keyword apply correctly to tunnel forwarding. o Potentially incompatible changes: - Use IANA allocated codepoint for ssh-mldsa44-ed25519 instead of '@openssh.com'. - Made sshd_config(5) DisableForwarding=yes override PermitTunnel=yes. - Enforce a maximum size for usernames in ssh-agent(1) agent key use constraints. - Disallow NUL byte in scp(1) '-O filename'. o New features: - New ssh-add(1) option '-P' to skip PIN entry (bz3635). - ssh(1) signal handling with readpassphrase(3) fixed. - Switched ssh(1) from supercop ed25519 to libsodium. - Extended ssh(1) TCPKeepAlive to support forwardings (bz3921). - Added ssh-keygen(1) 'hexdump' to dump the key blob in hex format. - Allow setting/clearing ssh-keygen(1) touch-required/verify-required flags on FIDO private keys when resetting the passphrase. - Added ssh(1) '-Z user@host' mode that lists pubkeys that will be tried for authentication. - Added experimental ssh(1) support for composite post-quantum mldsa44-ed25519 signature scheme. - Added an explicit-seed variant of the ssh(1) keygen function. - Added signature malleability and pubkey validity checks to sshd(8) ed25519 verification. o Bugfixes: - Check ssh(1) compressed payloads don't inflate beyond the maximum payload length. - Avoid race between multiple ssh(1) processes establishing multiplexing control socket. - Plugged memory leak in ssh-add(1) (CID 913600). - Fix for ssh(1) CIDs 913601 and 913602. - Fix for ssh(1) CID 913600. - Converted ssh(1) channel timeouts to allow fractional and subsecond timeouts. - Made ssh(1) masking signals correctly use sigaddset (bz3981). - Fixed ssh(1) memleaks (CID 913598 and 913599); added missing semicolon (CID 913599). - Corrected Daylight Savings Time timestamp conversion by ssh(1) (bz4004). - Fixed ssh(1) proxy socket breakage in t-multiplex after recent pledge(2) changes. - Reading server banner by ssh-keyscan(1) no longer blocks/freezes on a many-host keyscan. - Allow session-bind@openssh.com requests when the ssh(1) agent is locked. - Avoid potential realloc use-after-free in the ssh(1) client. - Reordering of certificates tried during ssh(1) pubkey authentication. - Fixed ssh(1) ML-KEM/ECDH interop problem. - Removed some key ssh(1) parsing and verification paths from the pre-auth attack surface. - Avoid download to server-controlled path when performing ssh(1) download via commandline. - Avoid possible NULL deref in ssh(1); sanitise filenames received via remote glob. - Large refactoring of sshd(8) config management code. - Made sshd(8) force domain name received from the system resolver to lowercase. - Fixed two one-byte out-of-cound reads in sshd(8). - Stricter validation of transport state passed from the preauth to postauth sshd(8) process. - Fixed ssh(1) client use-after-free on error path if cipher_init() fails. - Added ssh-agent(1) -V to print version, use it to test the binary is functional after relinking. - Stopped ssh(1) validating bad cipher/mac lists arguments as valid. - Fixed ssh(1) NULL deref during pubkey auth. - Dropbear recently added a -Q option; make ssh(1) use it to query KEX if available. - Classify ssh(1) dynamic-tcpip channels as bulk, not interactive (bz3958). - Ports and packages: o Pre-built packages are available for the following architectures on the day of release: - aarch64 (arm64): 12907 - amd64: 13060 - i386: 10659 - mips64: 9072 - powerpc64: 9564 - sparc64: 10621 o Packages for the following architectures will be made available as their builds complete: - arm - powerpc - riscv64 - Some highlights: o Asterisk 20.21.0 and 22.11.0 o OCaml 4.14.2 o Audacity 3.7.9 o OpenLDAP 2.6.15 o CMake 4.3.5 o PHP 8.3.33, 8.4.26 and o Chromium 154.0.8037.92 8.5.11 o Emacs 31.1 o Postfix 3.5.28 and 3.11.7 o FFmpeg 9.0.2 o PostgreSQL 18.6 o GCC 16.1.0 o Prism Launcher 11.1.0 o GHC 9.10.3 o Python 2.7.18 and 3.14.7 o GNOME 49 o Qt 5.15.19 (+ kde patches) and o Go 1.27.1 6.11.2 o JDK 11.0.32, 17.0.20, 21.0.12, o R 4.6.1 and 25.0.4 o Ruby 3.3.12, 3.4.11 and 4.0.7 o KDE Gear 26.08.1 o Rust 1.98.1 o KDE Frameworks 6.30.0 o SQLite 3.53.2 o KDE Plasma 6.7.5 o Shotcut 26.8.1 o Krita 6.0.3 o Sudo 1.9.17p2 o LLVM/Clang 21.1.8 and 22.1.8 o Suricata 7.0.7 o LibreOffice 26.8.0.3 o Tcl/Tk 8.5.19, 8.6.18 and 9.0.4 o Lua 5.1.5, 5.2.4, 5.3.6, o TeX Live 2026 5.4.8 and 5.5.1 o Vim 9.2.1125, Neovim 0.12.5 and o MariaDB 12.3.3 Vim-Classic 2026091 o Mono 6.14.1 o Wayland 1.26.0 with compositors o Mozilla Firefox 157.0 and CoW, Labwc, Mango, Niri, Sway and ESR 153.4.0 Wayfire o Mozilla Thunderbird 153.4.0 o Vulkan 1.4.357.0 o Mutt 2.4.2 and NeoMutt 20260616 o Xfce 4.20.0 o Node.js 24.21.0 and Deno 2.9.7 - As usual, steady improvements in manual pages and other documentation. - The system includes the following major components from outside suppliers: o Xenocara (based on X.Org 7.7 with xserver 21.1.24 + patches, freetype 2.14.3, fontconfig 2.17.1, Mesa 25.0.7, xterm 410, xkeyboard-config 2.20, fonttosfnt 1.2.5 and more) o LLVM/Clang 22.1.6 (+ patches) o GCC 4.2.1 (+ patches) and 3.3.6 (+ patches) o Perl 5.42.3 (+ patches) o pkgconf 3.0.7 o NSD 4.15.2 o Unbound 1.26.1 o Ncurses 6.4 o Binutils 2.17 (+ patches) o GDB 6.3 (+ patches) o Awk 20250116 o Expat 2.8.4 o zlib 1.3.2 (+ patches) ------------------------------------------------------------------------ - SECURITY AND ERRATA -------------------------------------------------- We provide patches for known security threats and other important issues discovered after each release. Our continued research into security means we will find new security problems -- and we always provide patches as soon as possible. Therefore, we advise regular visits to https://www.OpenBSD.org/security.html and https://www.OpenBSD.org/errata.html ------------------------------------------------------------------------ - MAILING LISTS AND FAQ ------------------------------------------------ Mailing lists are an important means of communication among users and developers of OpenBSD. For information on OpenBSD mailing lists, please see: https://www.OpenBSD.org/mail.html You are also encouraged to read the Frequently Asked Questions (FAQ) at: https://www.OpenBSD.org/faq/ ------------------------------------------------------------------------ - DONATIONS ------------------------------------------------------------ The OpenBSD Project is a volunteer-driven software group funded by donations. Besides OpenBSD itself, we also develop important software like OpenSSH, LibreSSL, OpenNTPD, OpenSMTPD, the ubiquitous pf packet filter, the quality work of our ports development process, and many others. This ecosystem is all handled under the same funding umbrella. We hope our quality software will result in contributions that maintain our build/development infrastructure, pay our electrical/internet costs, and allow us to continue operating very productive developer hackathon events. All of our developers strongly urge you to donate and support our future efforts. Donations to the project are highly appreciated, and are described in more detail at: https://www.OpenBSD.org/donations.html ------------------------------------------------------------------------ - OPENBSD FOUNDATION --------------------------------------------------- For those unable to make their contributions as straightforward gifts, the OpenBSD Foundation (https://www.openbsdfoundation.org) is a Canadian not-for-profit corporation that can accept larger contributions and issue receipts. In some situations, their receipt may qualify as a business expense write-off, so this is certainly a consideration for some organizations or businesses. There may also be exposure benefits since the Foundation may be interested in participating in press releases. In turn, the Foundation then uses these contributions to assist OpenBSD's infrastructure needs. Contact the foundation directors at directors@openbsdfoundation.org for more information. ------------------------------------------------------------------------ - RELEASE SONG --------------------------------------------------------- OpenBSD 8.0 comes with the song "The Simps on AI". An explanation of the song may be found at: https://www.OpenBSD.org/lyrics.html#80 ------------------------------------------------------------------------ - HTTPS INSTALLS ------------------------------------------------------- OpenBSD can be easily installed via HTTPS downloads. Typically you need a single small piece of boot media (e.g., a USB flash drive) and then the rest of the files can be installed from a number of locations, including directly off the Internet. Follow this simple set of instructions to ensure that you find all of the documentation you will need while performing an install via HTTPS. 1) Read either of the following two files for a list of HTTPS mirrors which provide OpenBSD, then choose one near you: https://www.OpenBSD.org/ftp.html https://ftp.openbsd.org/pub/OpenBSD/ftplist As of October 20, 2026, the following HTTPS mirror sites have the 8.0 release: https://cdn.openbsd.org/pub/OpenBSD/8.0/ Global https://ftp.eu.openbsd.org/pub/OpenBSD/8.0/ Stockholm, Sweden https://ftp.hostserver.de/pub/OpenBSD/8.0/ Frankfurt, Germany https://ftp.bytemine.net/pub/OpenBSD/8.0/ Oldenburg, Germany https://ftp.fr.openbsd.org/pub/OpenBSD/8.0/ Paris, France https://mirror.aarnet.edu.au/pub/OpenBSD/8.0/ Brisbane, Australia https://ftp.usa.openbsd.org/pub/OpenBSD/8.0/ CO, USA https://ftp5.usa.openbsd.org/pub/OpenBSD/8.0/ CA, USA https://mirror.esc7.net/pub/OpenBSD/8.0/ TX, USA https://openbsd.cs.toronto.edu/pub/OpenBSD/8.0/ Toronto, Canada https://cloudflare.cdn.openbsd.org/pub/OpenBSD/8.0/ Global https://fastly.cdn.openbsd.org/pub/OpenBSD/8.0/ Global The release is also available at the master site: https://ftp.openbsd.org/pub/OpenBSD/8.0/ Alberta, Canada However it is strongly suggested you use a mirror. Other mirror sites may take a day or two to update. 2) Connect to that HTTPS mirror site and go into the directory pub/OpenBSD/8.0/ which contains these files and directories. This is a list of what you will see: ANNOUNCEMENT armv7/ octeon/ root.mail README hppa/ openbsd-80-base.pub sparc64/ SHA256 i386/ packages/ src.tar.gz SHA256.sig landisk/ packages-stable/ sys.tar.gz alpha/ loongson/ ports.tar.gz xenocara.tar.gz amd64/ luna88k/ powerpc64/ arm64/ macppc/ riscv64/ It is quite likely that you will want at LEAST the following files which apply to all the architectures OpenBSD supports. README - generic README root.mail - a copy of root's mail at initial login. (This is really worthwhile reading). 3) Read the README file. It is short, and a quick read will make sure you understand what else you need to fetch. 4) Next, go into the directory that applies to your architecture, for example, amd64. This is a list of what you will see: BOOTIA32.EFI* bsd* floppy80.img pxeboot* BOOTX64.EFI* bsd.mp* game80.tgz xbase80.tgz BUILDINFO bsd.rd* index.txt xfont80.tgz INSTALL.amd64 cd80.iso install80.img xserv80.tgz SHA256 cdboot* install80.iso xshare80.tgz SHA256.sig cdbr* man80.tgz base80.tgz comp80.tgz miniroot80.img If you are new to OpenBSD, fetch _at least_ the file INSTALL.amd64 and install80.iso. The install80.iso file (roughly 794MB in size) is a one-step ISO-format install CD image which contains the various *.tgz files so you do not need to fetch them separately. If you prefer to use a USB flash drive, fetch install80.img and follow the instructions in INSTALL.amd64. 5) If you are an expert, follow the instructions in the file called README; otherwise, use the more complete instructions in the file called INSTALL.amd64. INSTALL.amd64 may tell you that you need to fetch other files. 6) Just in case, take a peek at: https://www.OpenBSD.org/errata.html This is the page where we talk about the mistakes we made while creating the 8.0 release, or the significant bugs we fixed post-release which we think our users should have fixes for. Patches and workarounds are clearly described there. ------------------------------------------------------------------------ - X.ORG FOR MOST ARCHITECTURES ----------------------------------------- X.Org has been integrated more closely into the system. This release contains X.Org 7.7. Most of our architectures ship with X.Org, including amd64, sparc64 and macppc. During installation, you can install X.Org quite easily using xenodm(1), our simplified X11 display manager forked from xdm(1). ------------------------------------------------------------------------ - PACKAGES AND PORTS --------------------------------------------------- Many third party software applications have been ported to OpenBSD and can be installed as pre-compiled binary packages on the various OpenBSD architectures. Please see https://www.openbsd.org/faq/faq15.html for more information on working with packages and ports. Note: a few popular ports, e.g., NSD, Unbound, and several X applications, come standard with OpenBSD and do not need to be installed separately. ------------------------------------------------------------------------ - SYSTEM SOURCE CODE --------------------------------------------------- The source code for all four subsystems can be found in the pub/OpenBSD/8.0/ directory: xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz The README (https://ftp.OpenBSD.org/pub/OpenBSD/8.0/README) file explains how to deal with these source files. ------------------------------------------------------------------------ - THANKS --------------------------------------------------------------- Ports tree and package building by Jeremie Courreges-Anglas, Visa Hankala, Stuart Henderson, Peter Hessler, George Koehler, Kurt Mosiejczuk, and Christian Weisgerber. Base and X system builds by Kenji Aoyama and Theo de Raadt. Release art by "yvaneht nioj and clanker". We would like to thank all of the people who sent in bug reports, bug fixes, donation cheques, and hardware that we use. We would also like to thank those who bought our previous CD sets. Those who did not support us financially have still helped us with our goal of improving the quality of the software. Our developers are: Aaron Bieber, Adam Wolk, Aisha Tammy, Alexander Bluhm, Alexander Hall, Alexandr Nedvedicky, Alexandr Shadchin, Alexandre Ratchov, Andrew Hewus Fresh, Anil Madhavapeddy, Anthony J. Bentley, Antoine Jacoutot, Anton Lindqvist, Asou Masato, Ayaka Koshibe, Benoit Lecocq, Bjorn Ketelaars, Bob Beck, Brandon Mercer, Brent Cook, Bryan Steele, Can Erkin Acar, Caspar Schutijser, Charlene Wendling, Charles Longeau, Chris Cappuccio, Christian Ludwig, Christian Weisgerber, Christopher Zimmermann, Claudio Jeker, Dale Rahn, Damien Miller, Daniel Dickman, Daniel Jakots, Darren Tucker, Dave Voutila, David Coppa, David Gwynne, David Hill, David Leadbeater, Denis Fondras, Edd Barrett, Eric Faurot, Florian Obser, Florian Riehm, Frederic Cambus, George Koehler, Gerhard Roth, Giannis Tsaraias, Gilles Chehade, Giovanni Bechis, Gleydson Soares, Gonzalo L. Rodriguez, Greg Steuck, Hans-Joerg Hoexer, Helg Bredow, Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Feinerer, Ingo Schwarze, James Hastings, James Turner, Jan Klemkow, Jason McIntyre, Jasper Lievisse Adriaanse, Jeremie Courreges-Anglas, Jeremy Evans, Job Snijders, Joel Sing, Joerg Jung, Johannes Thyssen Tishman, Jonathan Armani, Jonathan Gray, Jonathan Matthew, Jordan Hargrave, Josh Rickmar, Joshua Sing, Joshua Stein, Juan Francisco Cantero Hurtado, Kazuya Goda, Kenji Aoyama, Kenjiro Nakayama, Kenneth R Westerback, Kent R. Spillner, Kevin Lo, Kirill A. Korinsky, Kirill Bychkov, Klemens Nanni, Kurt Miller, Kurt Mosiejczuk, Landry Breuil, Lawrence Teo, Lucas Gabriel Vuotto, Lucas Raab, Marcus Glocker, Mark Kettenis, Mark Lumsden, Markus Friedl, Martijn van Duren, Martin Natano, Martin Reindl, Martynas Venckus, Matthew Dempsky, Matthias Kilian, Matthieu Herrb, Michael Mikonos, Mike Belopuhov, Mike Larkin, Miod Vallat, Moritz Buhl, Nam Nguyen, Nayden Markatchev, Nicholas Marriott, Nigel Taylor, Okan Demirmen, Omar Polo, Ori Bernstein, Otto Moerbeek, Paco Esteban, Pamela Mosiejczuk, Pascal Stumpf, Patrick Wildt, Paul Irofti, Pavel Korovin, Peter Hessler, Philip Guenther, Pierre-Emmanuel Andre, Pratik Vyas, Rafael Sadowski, Rafael Zalamena, Ralph Covelli, Raphael Graf, Remi Locherer, Remi Pointel, Renato Westphal, Renaud Allard, Ricardo Mestre, Richard Procter, Rob Pierce, Robert Nagy, Sasano Takayoshi, Scott Soule Cheloha, Sebastian Benoit, Sebastian Reitenbach, Sebastien Marie, Solene Rapenne, Stefan Fritsch, Stefan Hagen, Stefan Kempf, Stefan Sperling, Steven Mestdagh, Stuart Cassoff, Stuart Henderson, Sunil Nimmagadda, T.J. Townsend, Ted Unangst, Theo Buehler, Theo de Raadt, Thomas Frohwein, Tim van der Molen, Tobias Heider, Tobias Stoeckmann, Todd C. Miller, Todd Mortimer, Tom Cosgrove, Tracey Emery, Ulf Brosziewski, Uwe Stuehler, Vadim Zhukov, Vincent Gross, Visa Hankala, Vitaliy Makkoveev, Volker Schlecht, Yasuoka Masahiko, Yojiro Uo