From Report to Patch, the OpenBSD Errata Process
Summary
This article discusses the OpenBSD errata process, detailing how vulnerabilities are reported and patched in the OpenBSD operating system.
Similar Articles
An AI audit of FreeBSD
An AI-assisted security audit of FreeBSD uncovered 15 kernel vulnerabilities, including privilege escalations and a VM escape, and details the collaborative process of reporting and patching bugs with the FreeBSD team.
score by collisions, patch by panic
The article proposes a new severity model for vulnerability reporting based on collision counts and the presence of working exploits, arguing that the current disclosure model is broken and that patches should be prioritized when multiple researchers find the same bug or exploits are public.
Linux Compromises, Broken Embargoes, and the Shrinking Patch Window
A report on three serious Linux local privilege escalation vulnerabilities discovered in May 2026, highlighting breakdowns in the disclosure model and implications for production environments.
How to fix a bug in a fix
Project Zero shares guidance on how large vendors build emergency patch delivery systems that can remediate critical vulnerabilities much faster than their normal update pipelines, covering triage, testing, delivery, and activation challenges.
Work on GEFS (the Good Enough File System) for OpenBSD progresses
Work on GEFS (Good Enough File System) for OpenBSD continues to progress, with Ori Bernstein posting updates on error handling, ported bugfixes, userspace tools, and remaining consistency protocol challenges to the openbsd-tech list.