This is a significant package update for the repository, not just for applications, but also for some of the base system packages. There are a lot of changes from upstream FreeBSD and TrueOS in this release, from additional “-bootstrap” base packages to the renaming of the “zol” flavor of base packages to “nozfs”, as the “zol” version of the ZFS packages was also renamed to “openzfs”. In addition to this, a ton of the default settings from upstream TrueOS were changed.
FreeBSD has issued a security advisory for multiple vulnerabilities in POSIX largepage objects (CVE-2026-49427, CVE-2026-49428) that allow unprivileged local users to access freed kernel memory and escalate privileges, with patches available for all supported releases.
A use-after-free in the TCP RACK stack option handler may allow an unprivileged local user to escalate privileges on all supported FreeBSD versions; patches and updated binaries are available.
The unlinkat(2) and funlinkat(2) system calls ignore the ATRESOLVEBENEATH flag, allowing path resolution to escape the intended directory and delete files outside the confined tree. Patches are available for FreeBSD 14.3, 14.4, 15.0, and 15.1.
A buffer overflow in the libalias RTSP handler affects all supported FreeBSD versions and can allow remote code execution in the kernel via ipfw(4) NAT or in natd(8) when libalias_smedia.so is loaded.
FreeBSD has issued a security advisory for OpenZFS with three vulnerabilities: a kernel heap overflow via ZFSIOCUSERSPACEMANY for users with "userused" permission, kernel memory corruption via ZFSIOCRECVNEW for users with "receive" permission, and an ability for any local user to set the "$hasrecvd" metadata flag via ZFSIOCSET_PROP, affecting all supported FreeBSD versions.
GhostBSD reports 1,364.91 CAD in March donations, lists infrastructure and hardware expenses totaling 857.68 CAD, and notes 500.00 CAD added to the server fund for a future Ampere ARM server.
Both relayd and httpd now use a "secure" list of allowed crypto methods for HTTPS, including TLSv1.3 and TLSv1.2 AEAD cipher suites, replacing the previous "HIGH:!aNULL" list which contained non-perfect-forward-security methods and may cause old clients to fail to connect.
This week's roundup covers OpenBSD amd64 kernel virtual address space expanding to 512GB, a patch for missing PKGBASE in FreeBSD jails, FreeBSD Git weekly reports, a new FreeBSD Core Team election, Sylve 0.3.0 adding a PF firewall and WireGuard manager, BSD Now 669 on Poudriere speed, and more.
Author details porting devel/corrosion and devel/cxxbridge-cmd to handle Rust dependencies in CMake-based KDE Plasma ports under OpenBSD's PORTS_PRIVSEP, and fixes a truncation bug in httpd(8) error documents by routing them through bufferevent instead of a single write, plus a privilege-separation bounds-check fix shared by httpd, relayd, iked, and snmpd.
GhostBSD has an out-of-the-box firewall. This video shows what options there for configuration using the terminal.
This episode covers native inotify in FreeBSD, how poudriere.conf changes affect build time, migrating mail servers from exim to OpenSMTPD, and a recap of the April 2026 Frankfurt FreeBSD hackathon.