Loading story…
The FreeBSD Project issued six security advisories addressing eight vulnerabilities in the FreeBSD kernel, mac_do policy module, and ppp(8). Two critical flaws in ppp(8), tracked as CVE-2026-58095 and CVE-2026-58096, have CVSS v3 scores of 9.8 and could allow a malicious PPP peer to crash the service or potentially execute arbitrary code with root privileges.
The remaining issues include local privilege-escalation risks arising from use-after-free, race-condition, time-of-check/time-of-use, and credential-handling weaknesses. No active exploitation or public proof-of-concept has been reported; FreeBSD administrators should apply the relevant supported-branch security updates and reboot affected systems.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
The FreeBSD Project issued six security advisories addressing eight vulnerabilities in the kernel, mac_do policy module, and ppp(8), including critical PPP flaws that could allow a malicious peer to crash ppp(8) or potentially execute code as root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreeBSD released security updates for **22 vulnerabilities** across the operating system, including multiple flaws that could lead to **remote code execution**, **local privilege escalation to root**, **denial of service**, **memory corruption**, and **information disclosure**. The most severe issue, **`CVE-2026-49420`**, affects `libalias`, where improper handling of **RTSP** traffic during NAT processing can allow **remote code execution as root** on systems using **`ipfw` NAT** or **`natd`**. The fixes were shipped in **FreeBSD 15.1-RELEASE-p1**, **15.0-RELEASE-p11**, **14.4-RELEASE-p7**, and **14.3-RELEASE-p16**. Additional patched components include `execve`, **Jail**, **OpenZFS**, **Linuxulator**, **KTLS**, `sound`, `vt`, `ptrace`, IPv6 multicast filtering, `tcp_rack`, `compat32`, `iconv`, and pathname resolution protections such as **`AT_RESOLVE_BENEATH`**, with the advisory noting that **13 of the issues** could enable privilege escalation to root.
Jul 7, 2026
The FreeBSD Project issued security advisory **FreeBSD-SA-26:10.tty** for **CVE-2026-5398**, a kernel use-after-free flaw in the `TIOCNOTTY` handler that affects all supported FreeBSD versions. The vulnerability occurs because `TIOCNOTTY` does not clear a back-pointer from the controlling terminal structure to the calling process session, leaving a dangling pointer after the process exits. FreeBSD warned that a malicious unprivileged local process could exploit the bug to gain **root privileges**. The project released fixes across supported stable and release branches on 2026-04-21, said **no workaround is available**, and directed administrators to apply the updates and reboot affected systems.
Jun 29, 2026
OpenBSD fixed a high-severity authentication bypass in its PPP stack after researchers disclosed that the bug had existed since the original `sppp` code import from FreeBSD in 1999. The flaw affects `sppp_pap_input()` and all OpenBSD releases through 7.6 when the system is configured as a PAP authenticator on the PPPoE data path. By trusting attacker-controlled `name_len` and `passwd_len` values in `bcmp()` comparisons, the code could accept zero-length credentials as valid because a zero-length `bcmp()` returns success, allowing remote attackers to authenticate without legitimate credentials. The disclosure also described a secondary kernel heap over-read caused when a supplied username length exceeds the allocated size of the stored credential, a condition introduced after credential fields became dynamically allocated in 2009. Researchers said the bug could let an attacker intercept or read PPPoE traffic and could also allow a rogue PPPoE server to impersonate a legitimate server during mutual authentication. OpenBSD committed a fix to `-current` on 2026-06-14, and a proof of concept reportedly showed successful PAP authentication with empty credentials followed by establishment of a full network-layer link.
Jun 29, 2026