[openbsd]

October 17, 2026

• OpenBSD local privilege escalation to root, with full exploit code, lands on a shm_nattch attach counter defined as a signed 16-bit short in the original BSD sources. The path: map 127 SysV shared-memory segments, munmap() them, fork 259 processes to wrap the counter to −32,643, groom the heap using sysctl(KERN_MALLOCSTATS), win an IPC_RMID race for a use-after-free, then use a conditional −1 out-of-bounds write against a 16-byte struct ip_moptions to flip the PTE self-referential mapping from user to supervisor and execute kernel code (Calif, The Hacker News). Fixed in errata 026 and 018; phendrenad2 notes the same bug appears to have been fixed by accident in NetBSD during a 1999 rewrite (discussion). · Exploits & Offensive Research

in Thirty-Seven Years of a Signed Short, and a Root Shell on OpenBSD

June 22, 2026

• CVE-2026-56099 in OpenBSD causes an out-of-bounds kernel read and remote info disclosure when handling crafted MPLS frames carrying 16 labels without a bottom-of-stack marker. Argus advisory. · Vulnerabilities & Exploits

in Unpatchable iPhone BootROM Exploit Drops as a New Call-Stack Bypass Defeats 2024-Era EDR

June 17, 2026

• OpenBSD patched a 27-year-old remote kernel auth bypass in its PPP/PPPoE stack (a null-auth flaw imported from FreeBSD in 1999), allowing credential-less traffic interception. Argus-Systems, r/netsec. · Vulnerabilities & Exploits (Actively Exploited)

in Microsoft 365 Copilot 'SearchLeak' Enables One-Click Data Theft as Novo Nordisk Loses Internal AI Models to Extortionists