OpenBSD 8.0: The Release Is Only the Start of the Patch Plan

OpenBSD 8.0 arrived on 20 October with changes to everyday components, including archive handling, network services and remote access. The project’s release notes also document platform and virtualisation improvements. For an operator, the meaningful work is narrower than the long feature list: identify the machines running OpenBSD, the services they expose and the configuration changes an upgrade will bring.

The release includes updated OpenSSH and LibreSSL components. Those are useful reasons to test remote access and certificate-dependent applications after upgrading, but an OpenBSD base-system update does not automatically update an independently installed copy elsewhere in the organisation.

OpenBSD’s 8.0 errata page already lists five entries dated 20–23 October. Among them are NSD security fixes and a kernel heap overflow that can be remotely triggered when IPsec uses AES-GMAC on the affected amd64 or octeon hardware. The project explicitly says AES-GCM is unaffected. Other entries cover PPP, video-driver memory safety and refreshed certificate and timezone data.

Signed source patches are available, and syspatch provides full binary updates on amd64, i386 and arm64. The errata page notes more limited binary-update availability on other architectures. Track release installation and subsequent errata application as separate completion checks.

1. 1

   Inventory and test. Record current release, architecture, exposed services and locally maintained software. Test a critical or physically remote machine on an equivalent local system first, as OpenBSD recommends.

2. 2

   Upgrade sequentially. The project supports 7.9 to 8.0, not arbitrary release jumps. Review disk space, configuration changes and package migrations before using sysupgrade or another documented method.

3. 3

   Apply errata and verify. Install applicable patches, update packages, and confirm remote login, VPN, DNS and certificate-dependent services after the system returns. Record any architecture-specific gaps.

A successful boot is not the end of the change. The release, its errata, installed packages and the services your users rely on all need their own verification.

The Cyber Security Hub newsletter surfaced the OpenBSD 8.0 release. Threat Field Notes checked the project’s release notes, errata and upgrade guide, then focused this note on the actions an operator can verify.