[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNIKoaSpKX8btBvqoY6O3eIwF91RPXfpu3KD-UZJTfOc":3},{"article":4,"iocs":45,"watch_terms":46,"solutions":47,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"caa5ecc2-252c-464d-b711-5050196128a4","Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug","researchers-demonstrate-openbsd-root-exploit-chaining-37-year-old-shared-memory--ebaf37","A local privilege escalation exploit published today gains root on OpenBSD 7.9 by chaining a roughly 37-year-old integer overflow with a separate kernel flaw, bypassing OpenBSD's KARL kernel-address randomization and its SMAP and SMEP hardware protections. Security firm Calif, which found and reported the flaws, published a detailed writeup and full proof-of-concept code after OpenBSD shipped","Researchers have demonstrated a local privilege escalation exploit on OpenBSD 7.9. The exploit chains a nearly 37-year-old integer overflow vulnerability with a separate kernel flaw, successfully bypassing OpenBSD's KARL kernel-address randomization and hardware protections like SMAP and SMEP. Security firm Calif discovered and reported the vulnerabilities, releasing a proof-of-concept after OpenBSD addressed the issues.","OpenBSD root exploit chains 37-year-old bug with kernel flaw, bypassing protections.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fresearchers-demonstrate-openbsd-root.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgqmitTMm5t8BBKfynqzFAKqJSzh_s7fQczmMm5u95RLUUzuWMubd5DeM8e8EH6YOpP-_gvbYwn8Cd3flsL-nGIupBw5HOo49Orr7J2rqhI99J7U4LcXW6shlxd3w0zFAng1mLw5xGb-F9GRmpDK82GC1-Dcb1gPcvkgl4wVi0-QTEGalDwPmelGE0TtNU\u002Fs1600\u002Fopenbsd.jpg","2026-10-16T17:48:45+00:00","2026-10-16T20:00:06.514323+00:00",8,[17,20,23,25],{"name":18,"type":19},"OpenBSD 7.9","product",{"name":21,"type":22},"OpenBSD","vendor",{"name":24,"type":19},"KARL",{"name":26,"type":22},"Calif","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[21,26,18],{"controls":48,"vendors":136},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":108,"name":109,"problem":110,"products":111},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":152},"openbsd-root-exploit-chains-decades-old-bug-to-bypass-kernel-protections","OpenBSD Root Exploit Chains Decades-Old Bug to Bypass Kernel Protections","Researchers successfully demonstrated a local privilege escalation attack on OpenBSD 7.9 by chaining a 37-year-old integer overflow vulnerability with a modern kernel flaw, bypassing advanced protections including KARL, SMAP, and SMEP. This highlights how legacy code vulnerabilities can persist undetected for decades and remain exploitable even in security-hardened operating systems. The ability to chain an ancient bug with a newer flaw underscores the compounding risk of unaudited legacy code in critical system components. It matters because privilege escalation on a local system can serve as the launchpad for broader network compromise, data theft, or ransomware deployment. Prompt patching after responsible disclosure—as OpenBSD performed here—remains one of the most effective mitigations.",[142,143,144,145,146,147,148,149,150,151],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 18: Application Software Security","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SI-16: Memory Protection","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","OWASP: Integer Overflow (CWE-190)","ITIL 4: Change Enablement \u002F Patch Management Practice",{}]