Theo de Raadt released OpenBSD 8.0 on 20 October 2026, the system’s 61st release. The new major number doesn’t hide a revolution: OpenBSD bumps its version by one tenth every six months and, after .9, rolls over to the next digit, just as it went from 6.9 to 7.0. What it does bring is a long changelog, with plenty of hardware work (mostly amd64, arm64 and RISC-V) and the usual security sweep.
This release’s song is called “The Simps on AI” and the artwork is credited to “yvaneht nioj and clanker”. Coming from a project whose notes also mention reworking smtpd code “to avoid false bug reports from LLM scanners”, the joke explains itself.
The changes you’ll notice most
On amd64, the kernel’s virtual address space grows from 4 GB to 512 GB, and the pmap direct map is now placed at a random address. The first change has an immediate practical effect: the kernel can now map more than 4 GB of video memory, which modern graphics cards needed.
That leads to the other big news. The drm graphics drivers are synced with Linux 6.18.53 and inteldrm adds support for Intel Arc A-Series cards (DG2, Alchemist). There’s also a workaround for the GuC timeout errors seen on some Alder Lake machines.
Swap encryption, on by default in OpenBSD for many years, now uses the CPU’s AES instructions on amd64 and arm64, so it costs less. arm64 also gains hibernation, and on RISC-V the kernel supports the “V” vector extension, the Sstc timer and the Advanced Interrupt Architecture (AIA), and tells userland which CPU extensions are available.
Architectures: one moves to LLVM, another one leaves
sparc64 is now built with the LLVM/Clang toolchain. Going the other way, Loongson is retired: the port didn’t work with Clang 22 and the project chose to drop it rather than drag it along. If you own one of those MIPS machines, you stay on 7.9.
Laptops, Wi-Fi and suspend
A good share of the work targets Snapdragon laptops. The Qualcomm qwx Wi-Fi driver gets a huge batch of fixes and gains 802.11n with 40 MHz channels and working roaming between access points; qwz also adds 40 MHz 802.11n and can now suspend and resume. Machines such as the Samsung Galaxy Book4 Edge and the HONOR MagicBook Art 14 survive suspend, the Galaxy Book4 Edge touchscreen works, and there are new drivers for the BIOS interface and battery of Samsung laptops.
On wired networking, em recognises Panther Lake and Wildcat Lake devices and ix supports Intel E610. On ARM and RISC-V boards there’s support for the SpacemiT K1 and K3 SoCs, for Rockchip parts like the Radxa Zero 3, and for the Qualcomm Glymur (X2) SoC.
Virtualisation with vmm and vmd
The native hypervisor takes a big step: up to 64 vCPUs per virtual machine, x2APIC mode for guests, MSI/MSI-X interrupts for virtio devices, network checksum offload and better QCOW handling. The APIC modes that stopped 32-bit Linux guests from booting are fixed too.
Security: business as usual, in bulk
The security section of the notes is long and made of details. pledge and unveil tighten a bit more (man, makewhatis and man.cgi are now restricted with unveil), pax no longer extracts malicious archives outside the working directory, syspatch is hardened against tampered scripts and fw_update validates signatures and paths more strictly. There are fixes in dhcpd, iked, isakmpd, smtpd, nsd, Perl, the X server and libexpat, which moves to 2.8.4. If you’re curious why the project works this way, we covered it in OpenBSD’s security culture.
Two changes in defaults deserve a separate mention. httpd and relayd switch to the secure TLS cipher set instead of compat and HIGH:!aNULL, and both now reject ambiguous HTTP requests (obs-fold, mixed Content-Length and chunked) as RFC 9112 says. httpd also gains custom HTTP headers. And rtrd, an RPKI-to-Router protocol daemon, joins the base system to round off what rpki-client and bgpd already did.
OpenSSH 10.6, LibreSSL 4.4 and packages
8.0 brings OpenSSH 10.6 and LibreSSL 4.4.0. OpenSSH disables a compressor that could leak information through a side channel, fixes ChannelTimeout and RekeyLimit not being applied from sshd_config, and adds experimental support for the composite post-quantum mldsa44-ed25519 signature. LibreSSL makes X25519MLKEM768 the preferred TLS 1.3 group in libtls and fixes an OCSP check bypass in clients that require stapling.
The base system ships LLVM/Clang 22.1.6, Perl 5.42.3, Unbound 1.26.1, NSD 4.15.2 and xserver 21.1.24 with Mesa 25.0.7. There are over 13,000 packages for amd64, including GNOME 49, KDE Plasma 6.7.5, Xfce 4.20, GCC 16.1, Rust 1.98.1, Go 1.27.1, Python 3.14.7, PostgreSQL 18.6, Firefox 157, LibreOffice 26.8 and Wayland 1.26 with several compositors (Sway, Niri, Labwc, Wayfire, Mango and CoW).
Support and how to upgrade
OpenBSD patches its two most recent releases. With 8.0 out, 7.8 no longer receives security updates, and 7.9 stays supported until 8.1 arrives, expected in spring 2027. The schedule is on the OpenBSD page.
Upgrades are only supported from the immediately previous release, so from 7.9 all you need is:
# sysupgrade
# sysmerge
# pkg_add -usysupgrade downloads the sets, verifies their signatures and reboots to install on its own; afterwards you review the configuration with sysmerge and update your packages. Before starting, check that /usr has at least 1.1 GB and read the upgrade guide, because this time some changes can bite:
bgpdenforces 4-byte AS support by default (announce as-4bytechanges fromyestoenforce). If a neighbour still needs 2-byte AS, set it back toyesby hand.- Kea jumps from 2.4 to 3.2: the configuration has to be reviewed or rewritten and data moves from
/var/lib/keato/var/db/kea. - stalwart-mail moves to 0.16 and needs a full dump and restore.
libmaxminddbno longer bundles the old GeoLite databases; the packaged alternative is DB-IP, under CC-BY-4.0.
The install80.iso, install80.img and miniroot80.img images are on the usual mirrors. If you want to know where all this comes from, our history of BSD traces OpenBSD’s roots.
Sources: OpenBSD 8.0 release notes and upgrade guide from 7.9 to 8.0, from the OpenBSD Project; OpenBSD 8.0 Released With Intel Arc A-Series, Other Hardware Improvements, at Phoronix.