Loading story…
FreeBSD published security advisory FreeBSD-SA-26:14.pf covering the operating system’s pf packet filter subsystem. The advisory was released through the official FreeBSD security channel and was subsequently mirrored by third-party BSD security tracking sites, indicating a newly disclosed security issue affecting systems that rely on pf for firewalling and network traffic filtering.
Publicly available reference material provides only limited summary detail, but the advisory identifies pf as the affected component and signals that administrators should review the official FreeBSD notice for impacted versions, patch availability, and remediation guidance. Organizations using FreeBSD firewalls, gateways, or hosts with pf enabled should prioritize validation of exposure and apply vendor-provided fixes or mitigations as appropriate.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
FreeBSD issued security advisory FreeBSD-SA-26:14.pf concerning the pf component. A second reference the same day republishes the same advisory rather than describing a separate event.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT published **Advisory 2026-1162** for **OpenBSD**, warning that a vulnerability could allow a **denial-of-service** condition. Public details in the notice were limited, but the issue indicates that affected OpenBSD systems may be susceptible to service disruption if the flaw is triggered. dCERT also issued **Advisory 2026-1202** covering the **FreeBSD Project FreeBSD OS**, reporting **multiple vulnerabilities** in the operating system. While the advisory summary did not include technical specifics, the paired disclosures highlight newly published security issues affecting two major BSD platforms and signal that administrators should review vendor guidance, assess exposure, and prioritize relevant patches or mitigations.
Jun 29, 2026
FreeBSD released security updates for **22 vulnerabilities** across the operating system, including multiple flaws that could lead to **remote code execution**, **local privilege escalation to root**, **denial of service**, **memory corruption**, and **information disclosure**. The most severe issue, **`CVE-2026-49420`**, affects `libalias`, where improper handling of **RTSP** traffic during NAT processing can allow **remote code execution as root** on systems using **`ipfw` NAT** or **`natd`**. The fixes were shipped in **FreeBSD 15.1-RELEASE-p1**, **15.0-RELEASE-p11**, **14.4-RELEASE-p7**, and **14.3-RELEASE-p16**. Additional patched components include `execve`, **Jail**, **OpenZFS**, **Linuxulator**, **KTLS**, `sound`, `vt`, `ptrace`, IPv6 multicast filtering, `tcp_rack`, `compat32`, `iconv`, and pathname resolution protections such as **`AT_RESOLVE_BENEATH`**, with the advisory noting that **13 of the issues** could enable privilege escalation to root.
Jul 7, 2026
FreeBSD issued security advisory **FreeBSD-SA-26:11.amd64** for **`CVE-2026-6386`**, a kernel flaw in the amd64 routine **`pmap_pkru_update_range()`** that mishandles **1GB large page mappings**. The bug affects all supported FreeBSD versions on amd64 and arises when largepage mappings created with **`shm_create_largepage(3)`** are not handled correctly, causing a page directory page entry to be misinterpreted as a pointer to another page table page. FreeBSD warned that an **unprivileged local user** could exploit the issue to make the kernel treat userspace memory as a page table page and overwrite memory the application should not be able to access, creating a serious path to memory corruption and potential privilege impact. The project said **no workaround is available** and advised administrators to upgrade to corrected branches released after **2026-04-21** and reboot affected systems; fixes were published for **stable/15**, **releng/15.0**, **stable/14**, **releng/14.4**, **releng/14.3**, **stable/13**, and **releng/13.5**.
Jun 29, 2026