FreeBSD Released the Most Security Advisories in Project History in June 2026

On average, the FreeBSD security team releases about 2 security advisories per month. AI has changed this. 
 
In April, the project released 8 advisories, with 6 powered by AI.  In May, the count decreased slightly to 7. 
 
Today I took a look at the FreeBSD Security Advisory page to check the latest advisory count.
 
June saw the most number of advisories ever published in project history: 25.
 
This blows away the previous record of 18 from January 2001. The other big spike was 11 in January 2016.
 
AI apaprently discovered at least 9 of the June 2026 FreeBSD vulnerabilities.
 
On 15 June the FreeBSD Foundation announced the FreeBSD AI-assisted Vulnerability Discovery Project:
 
"The 6-month project is being funded by a grant from the Alpha Omega project. 
 
The funds will be used to engage FreeBSD Security Team members under fixed-term contracts to find and patch vulnerabilities. 
 
The Security Team’s access to publicly available AI models and tokens will be provided free of charge. AI will be used for vulnerability discovery and analysis only, all patches will be manually created." 
 
Yes, 25 vulnerabilities is far lower than the 570 associated with Patch Tuesday this week. However, it's important to see the effects of AI-powered vulnerability discovery everywhere. It's not hype. It is real. 
 
I am hopeful that developers will continue to use AI to discover and fix vulnerabilities in old code, and also prevent new code from shipping with vulnerabilities. 
 
Addendum:
 
I asked Gemini to explain the large number of advisories in 2001-2002. It said:
 
"The pronounced security advisory spike between August 2000 and January 2001 represents one of the most concentrated periods of security patching in FreeBSD's history, totaling 66 advisories in a six-month window.

A closer look at the specific advisories reveals that this spike was primarily driven by a massive wave of vulnerabilities discovered in popular third-party software (the "Ports" collection) along with critical auditing of core networking daemons.

1. Vulnerabilities in Popular Third-Party Software (Ports)

During this era, many open-source projects were grappling with newly pervasive exploitation techniques like buffer overflows and format string vulnerabilities. The dataset shows a massive batch of updates for staple utilities of the early-2000s internet:
 
Internet & Chat Clients: Multiple advisories were issued for communication tools, including the `pine` mail client, `xchat`, `gaim` (instant messaging), `bitchx` (IRC client), and the `netscape` web browser.
 
Web & Content Servers: Security flaws were patched in web servers and frameworks like `php`, `zope`, `thttpd`, and the `boa` web server.

Development & System Tools: Popular utilities like `curl`, `gnupg`, `cvsweb`, `ethereal` (now Wireshark), `syslog-ng`, and even alternative shells/editors like `bash1` and `joe` required immediate security patches.
 
2. Core System & Network Infrastructure Patches

Alongside user-facing applications, the core FreeBSD development team had to address architectural and networking vulnerabilities in the base system:
 
Routing & Firewalls: Critical flaws were patched in basic networking security logic, notably `ipfw` (the firewall tool) and `ppp-nat` (Network Address Translation).
 
Core Network Daemons: High-risk vulnerabilities struck standard network entry points, resulting in patches for `bind` (DNS server), `telnetd`, `dhclient`, and the newly adopted `openssh`.
 
Protocol & Kernel Level: Security advisories were issued for low-level system components like `tcp-iss` (Initial Sequence Number generation, crucial for preventing TCP hijacking) and filesystem-level wrappers like `procfs`.
 
3. The Climax: January 2001

The spike peaked dramatically in January 2001 alone with 18 advisories. This was largely an administrative and security "housecleaning" event. Rather than a single massive system failure, it reflects a coordinated effort by the FreeBSD Security Officer team to bundle and ship security patches for dozens of utilities simultaneously—including `crontab`, `inetd`, `mysql`, and `xfree86`—ensuring systems were hardened as the platform matured." 

Comments

Post a Comment

Popular posts from this blog

Zeek in Action Videos

Image
This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project .  Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like Suricata, Wireshark, and so on.  I am especially pleased with Video 6 on monitoring wireless networks . It took me several weeks to research material for this video. I had to buy new hardware and experiment with a Linux distro that I had not used before -- Parrot .  Please like and subscribe, and let me know if there is a topic you think might make a good video.
Read more

MITRE ATT&CK Tactics Are Not Tactics

Image
Just what are "tactics"? Introduction MITRE ATT&CK  is a great resource, but something about it has bothered me since I first heard about it several years ago. It's a minor point, but I wanted to document it in case it confuses anyone else. The MITRE ATT&CK Design and Philosophy document from March 2020 says the following: At a high-level, ATT&CK is a behavioral model that consists of the following core components: • Tactics, denoting short-term, tactical adversary goals during an attack; • Techniques, describing the means by which adversaries achieve tactical goals; • Sub-techniques, describing more specific means by which adversaries achieve tactical goals at a lower level than techniques; and • Documented adversary usage of techniques, their procedures, and other metadata. My concern is with MITRE's definition of "tactics" as "short-term, tactical adversary goals during an attack," which is oddly recursive. The key word in the tacti...
Read more

New Book! The Best of TaoSecurity Blog, Volume 4

Image
  I've completed the TaoSecurity Blog book series . The new book is  The Best of TaoSecurity Blog, Volume 4: Beyond the Blog with Articles, Testimony, and Scholarship .  It's available now for Kindle , and I'm working on the print edition.  I'm running a 50% off promo on Volumes 1-3 on Kindle through midnight 20 April. Take advantage before the prices go back up. I described the new title thus: Go beyond TaoSecurity Blog with this new volume from author Richard Bejtlich. In the first three volumes of the series, Mr. Bejtlich selected and republished the very best entries from 18 years of writing and over 18 million blog views, along with commentaries and additional material.  In this title, Mr. Bejtlich collects material that has not been published elsewhere, including articles that are no longer available or are stored in assorted digital or physical archives. Volume 4 offers early white papers that Mr. Bejtlich wrote as a network defender, either for technica...
Read more