OpenBSD 8.0: 61 Releases, 30 Years of History and Only Two Remote Holes

On October 20, 2026, the OpenBSD project announced the release of its 61st stable version: OpenBSD 8.0. The announcement, made by Theo de Raadt on the project's mailing list, marked the beginning of a new chapter for the operating system that turned 31 this month — and which continues to boast an unprecedented security record in the free software world: only two remotely exploitable vulnerabilities in the default install in more than three decades of development.

If this date seems recent for a system with that longevity, it is because OpenBSD releases follow a deliberate, regular cadence: major release every six months, on the first day of the month. Version 7.9 came in May 2026, and 8.0 arrives exactly six months later, as expected. What changes in this version, however, goes far beyond the numerical increment.

What is new in OpenBSD 8.0

The most visible change lies in the kernel address space. On amd64, the kernel virtual address space has grown from 4 GB to 512 GB — a 128-fold increase that reflects the reality of modern server and workstation machines. For administrators running memory-intensive workloads, this change eliminates an artificial barrier that, on machines with large amounts of RAM, could result in kernel address space exhaustion.

On the crypto front, LibreSSL 4.4.0 now uses X25519MLKEM768 as the preferred key exchange for TLS 1.3 connections — a post-quantum key exchange protocol combining the X25519 curve with the ML-KEM-768 encryption scheme from NIST. This represents a strategic evolution for the project: rather than waiting until post-quantum cryptography is mature enough to fully replace ECC, OpenBSD adopted a hybrid approach that maintains classic security against current threats while adding protection against future quantum computers.

OpenSSH 10.6 arrived alongside, with security fixes including the disabling of the LZ77 coder to avoid side-channel leaks, and the migration from supercop ed25519 to libsodium — a change that, while internal to the source code, reflects the project's ongoing commitment to robust cryptographic libraries.

In networking, PF (Packet Filter) queues can now break the 4 Gbps bandwidth control barrier, a significant improvement for installations requiring high-performance firewalls. httpd and relayd migrated their default TLS ciphers from "compat" and "HIGH:!aNULL" to "secure", respectively — a proactive change that forces stronger configurations even on systems that have not been manually tuned.

New drivers and hardware support

OpenBSD 8.0 adds support for several new hardware devices, including Intel E610 network cards (ix driver), Panther Lake and Wildcat Lake Ethernet devices (em driver), and substantial improvements to the qwx driver for Qualcomm Wi-Fi 6 cards. The qwx driver received a series of stability fixes, including correct handling of country code events, REO RX exception management, and crash prevention when leaving RUN state.

The arm64 architecture gained hibernate support — a long-awaited feature that allows saving the complete memory state to disk and restoring it on boot. The implementation uses signature writes via piglet I/O page, avoiding unreachable memory.

RISC-V received support for the "V" vector extension and the Advanced Interrupt Architecture, making RISC-V-based boards more serious targets for OpenBSD execution. The project also officially retired support for the loongson architecture, which "did not work with Clang 22", and migrated sparc64 to the LLVM toolchain.

OpenBSD's security philosophy

What makes OpenBSD 8.0 relevant goes beyond the technical features. The project continues operating under a security philosophy that few other operating systems have adopted — or attempted. From the earliest days, with the introduction of pledge(2) and unveil(2), OpenBSD followed a "default security" approach: unnecessary services disabled, minimal privileges, rigorous privilege separation between system components.

The "only two remote holes in more than 30 years" record is not marketing — it is a metric. A remote hole means a vulnerability in code that runs by default in the standard installation (basically: kernel + sshd on port 22) that can be exploited without prior authentication via the network. The first remote hole was discovered in 2001 (IPv6); the second, in 2007 (also in the IPv6 stack). Since then, none.

The project's continuous source code auditing strategy, combined with rigorous code review processes led by Theo de Raadt and its volunteer team, maintains this standard. The result is an operating system that, even in 2026, remains the security reference for firewalls, routers, and embedded servers in critical infrastructure.

What to watch

The migration to post-quantum cryptography via X25519MLKEM768 in LibreSSL is probably the most significant development in OpenBSD 8.0 in terms of long-term impact. As the security industry prepares for the transition to quantum-resistant algorithms, OpenBSD is already ahead — and the adoption of a hybrid approach ensures backward compatibility with systems that have not yet migrated.

The question that remains is: with 512 GB of kernel space and post-quantum protection already implemented, what is stopping OpenBSD from becoming the default security distribution for global critical infrastructure — and why do so many administrators continue using Linux on firewalls?

Sources: OpenBSD 8.0 release page, OS.watch, Tux Machines

✓ Independent sources cross-checked and verified before publishing