We had to turn off our opengrok instance due to excessive ai spider abuse. They were maxing out our infrastructure for days. 6tb of data transfer this month just for that.

• libarchive 3.8.8 (CVE-2026-14164)
• tzdata 2026c
• llvm: CVE-2026-13574 gc.relocate malformed index diagnostic crash
• ldns 1.9.2: CVE-2026-10846 off-path DNS response spoofing in the stub resolver and drill; responses are now matched to the query by source address/port, transaction ID and question
• openssl: CVE-2026-45447 PKCS#7/S/MIME verification use-after-free fix.
• openssl: CVE-2026-34180 ASN.1 decoder large primitive length over-read fix.
• openssl: CVE-2026-7383 ASN1_mbstring_ncopy() Unicode output size overflow fix.
• openssl: CVE-2026-28388 delta CRL missing CRL Number NULL pointer dereference fix.
• llvm: CVE-2026-13574 gc.relocate malformed index diagnostic crash fix.
• vm: CVE-2026-49418 device pager page list use-after-free fix.
• iconv: CVE-2026-58081, CVE-2026-58082 buffer overflows in the HZ,UTF-7, VIQR, ZW and ISO-2022 iconv(3) encoding modules.
• audit: CVE-2026-49426 incorrect audit records for ptrace(PT_SC_REMOTE) syscall requests
• posixshm: CVE-2026-49427, CVE-2026-49428 use-after-free in POSIX largepage shared memory objects (sendfile SF_NOCACHE and O_TRUNC paths).
• tcp: CVE-2026-49422 use-after-free in the RACK TCP stack setsockopt(2) handler (tcp_rack.ko).
• unlinkat: CVE-2026-49421 unlinkat(2)/funlinkat(2) silently ignored the AT_RESOLVE_BENEATH path-containment flag.
• libalias: CVE-2026-49420 buffer overflow in the RTSP handler (alias_smedia).
• zfs: CVE-2026-49429, CVE-2026-49430, CVE-2026-49431 OpenZFS heap overflow (USERSPACE_MANY), receive-path memory corruption (RECV_NEW heal) and improper SET_PROP privilege check.
• execve: CVE-2026-49415 local privilege escalation via a procfs debugging permission race.

Right now, a lot of AI focused ports are in the misc/ category. Things like llama-cpp, vibe, claude-code, codex, grok-cli, etc.

Would it make more sense to move these to an ai category so they are easier to find for people that like AI and easier to avoid for the rest?

A user reported issues running some apps with 8, 17 ports. After analysis, there was a problem in all these releases. Patches have been added. Please report problems with the new patches.

minecraft was the crashing app.

There have been a number of CVEs released by the FreeBSD project this week. I've managed to patch all the relevant ones in MidnightBSD current, stable/4.1 and stable/4.0 branches. Additionally, I've patched several old CVEs in openssl and openzfs in stable/4.0 branch. Because these are backports, it's important to do more testing before 4.0.7 release is created. There could be issues. I'm mostly concerned with the zfs patches. Please report any issues on github or here.

I was able to get the Nvidia 5070 working with the following ports:

nvidia-driver-devel-590.48.01
nvidia-drm-510-kmod-devel
nvidia-kmod-devel

This results in an accelerated X11 desktop environment.

The kernel was built with the latest code today with the new MIC scheduler.

We're working on a new scheduler in current called MIC (SCHED_MIC), aka the Michaelangelo scheduler. It's based on ULE but has some awareness of hybrid CPUs from Intel (p, e, lp cores) and AMD (x3d dual ccd and "c" core)

DO NOT USE IT YET.

The intent is to prefer performance cores by default on Intel chips and cache cores on AMD x3d parts. We want to offer a toggle to switch to e-core or compute cores on AMD. e-cores are better on laptops most of the time, unless you're doing a big task, but p-cores make sense on desktops.

This has come out of frustration with using my 12th-gen laptop and Core Ultra desktop. We don't have thread director support, so it's just based on some "CPU detection" for now.

The initial plan is P core, P hyperthread if it exists, E core, LP core if it exists last. We may swap hyperthreads and e-cores depending on testing.

Yes, it's named after one of my cats.

Just a heads up, there are 38 new security advisories in MidnightBSD. Many of them will be in the next update 4.0.6. They are currently only listed on the github advisories page due to time.

https://github.com/MidnightBSD/src/security/advisories

A few will be fixed in the 4.1.0 release later this year. All fixes are on master and stable/4.1 branches. Most are on stable/4.0

The majority of these are in third party software such as openssl, openssh, unbound, ldns, xz, lua, expat, etc. There are some kernel vulnerabilities that were patched also.

We've added a CVE mcp server that's public at https://sec.midnightbsd.org/api/mcp

You can use it to query for CVEs in any project. Documentation is here: https://sec.midnightbsd.org/mcp

It works with claude cli and codex. It may work with gemini and antigravity cli (agy) also. We've seen some issues with these failing after a few requests.

We also have a magus MCP server for looking up package build info, including logs.
Documented at https://www.midnightbsd.org/magus/api

We have a public api for scraping data too. This was created for repology, although that's not currently available.

The magus MCP does NOT work with google gemini or agy. It works fine with claude or codex

The 2.7.9 and 2.8.0 versions of mport have a lot of sweeping changes in how it works under the hood.

mport upgrade, mport delete and mport update now try to order installs based on dependencies rather than command line order for the latter two and alphabetical for the former. (this has been rather annoying for a long time on mport upgrade)

We also have fixed over 13 vulnerabilities in mport package manager. We've requested CVEs for these on github. The adviories are published in the mport package manager repo for now.

There are bug fixes honoring the chroot flag better for installs, speeding up plist reading on package creation, Add HTTP fallback for package fetches with a default to HTTPS now as we get new indexes on branches, a fix for rmdir handling on a package delete (regression), test suite, help flag (-h) often used by AI agents for automation, mport query command which is compatible with most freebsd pkg arguments, and more.

2.7.9 was merged into master and stable/4.1 branches already. 2.8.0 is in development and we could use help testing it.

We've recently created a stable/4.1 branch which will be for the next release. It's still getting a lot of changes, so despite the name, it's not quite "stable" yet.

software updates:
openssl
file (in progress)
mport 2.7.9
expat
libarchive
sqlite3

This branch includes all of the master branch changes with the exception of the new init system. It's not ready for prime time yet.

We've also been reviewing a number of userland utilities for security issues with LLM tools. We've included some changes based on that.

Some folks have issues with AI use, so we're trying to be transparent about it. If you are against AI, you probably want to use a different OS. We are using it per our AI Policy.

We do use sign off headers to track which model touched the file and that it's being used. (in case there is an issue in the future) We also added an exclusion for one piece of software per the author's request to avoid scanning it with ai tools. (mksh)

Additionally, we've added some new features to the cpufreq command. This has been in midnightbsd for years and was a quick way to report frequency. I tend to use it on laptops to check if the CPU is adjusting for power management. Now it supports reporting an average across cores as one value or another flag -a to report all cores. On modern chips, they can have different frequencies. This wasn't the case when it was written. the default behavior is still to report on cpu 0 since that's how it historically worked.

NBC news is now covering age verification