OpenBSD’s errata page is still one of my favorite security UX patterns: short, specific, patchable. The October 7 set called out isakmpd, X, expat, and wscons issues across the 7.8/7.9 track. If you run OpenBSD on a firewall, VPN endpoint, or laptop, this is not optional reading — it is the week’s work order.
Why I still care about errata days
isakmpd sits on the IPsec path. X and wscons touch local sessions. expat is the XML parse tax every network service eventually pays. None of that needs a press release. It needs syspatch and a reboot window you actually scheduled instead of hoped for.
I keep OpenBSD in the lab because the project’s defaults match how I want edge devices to behave — small attack surface, clear updates, less magic. Errata days are when that deal is tested. If your “secure BSD router” has not been patched in a month, it is a nostalgia appliance.
Do the work
Read the errata for 7.9 and 7.8. Run the syspatches. Confirm versions. If you have a second box, patch the spare first and fail over on purpose. Boring is the goal. Drama is a monitoring alert you earned.
I am writing these as lab notes for people who actually patch boxes. If a link goes stale, chase the upstream project page. The habit matters more than any single advisory number in a blog post.
Schedule the maintenance window while the advisory is still boring. Waiting until it is exciting costs more.
Have a blessed day!