OpenBSD 8.0 adds WPA3, post-quantum TLS and RISC-V vectors

The OpenBSD project released OpenBSD 8.0 on October 20, 2026, its 61st release. It adds WPA3 Wi-Fi security, prefers post-quantum key exchange for encrypted connections, and lifts an old memory limit in the amd64 kernel. For anyone who runs OpenBSD on firewalls, routers or servers, it is the version to plan an upgrade to.

What OpenBSD is

OpenBSD is a free, Unix-like operating system known for putting security first. Many developers use its tools every day without running it, because the project also builds OpenSSH, the standard program for logging into remote machines. It also maintains LibreSSL, a cryptography library for encrypted connections.

Security and encryption

The biggest changes sit in the bundled crypto. OpenBSD's release notes list OpenSSH 10.6 and LibreSSL 4.4.0.

LibreSSL now uses X25519MLKEM768 as the preferred key exchange for TLS 1.3 connections made through libtls, its simple TLS library. That is a hybrid method: it pairs a classic algorithm with ML-KEM, a newer one designed to resist future quantum computers. A connection stays safe as long as either half holds.

OpenSSH 10.6 adds an experimental post-quantum signature type, mldsa44-ed25519. It also disables an LZ77 compression coder "to avoid a potential side-channel leak," the notes say. We covered those changes when OpenSSH 10.6 shipped on its own.

The OpenBSD Journal, the project's community news site, lists further hardening:

• WPA3 support for Wi-Fi, the current standard for securing wireless networks.
• A fix for an operation cache corruption issue on AMD Zen 2 processors.
• The httpd web server and smtpd mail server are now relinked in a random order at each boot, which makes attacks that rely on known memory addresses harder.
• The man page tools are now limited by unveil, OpenBSD's way of restricting which files a program can see.

Kernel, networking and hardware

On amd64, the kernel's virtual address space grew "from 4G to 512G," according to the release notes. That is the range of memory addresses the kernel can use for itself, and the old 4GB ceiling was tight on large modern machines. Swap encryption is also faster, because it now uses the processor's built-in AES instructions on amd64 and arm64.

Networking gets several upgrades. The Journal says PF queues, the bandwidth controls in OpenBSD's firewall, now break the 4 Gbps barrier. The release also imports rtrd and rtrctl, new tools for routing security, and makes its httpd and relayd use more secure TLS settings by default.

Area	Change in 8.0
Virtual machines	vmm and vmd support multi-processor guests
Intel graphics	Arc A-Series (Alchemist) support; drm updated to Linux 6.18.53
Networking chips	Intel E610 (ix), Panther Lake and Wildcat Lake (em), Qualcomm WCN7850 (qwz)
RISC-V	Kernel support for the "V" vector extension and the Advanced Interrupt Architecture
Platforms	loongson retired; sparc64 moves to the LLVM toolchain
Desktop tools	tmux floating panes; hibernate on arm64

RISC-V is an open processor design that anyone can build on. Its vector extension lets a chip process many numbers in one instruction, which speeds up media and math-heavy code. The loongson port was retired because it was "not working with Clang 22," the notes say.

Packages and upgrades

The ports collection, OpenBSD's library of add-on software, has 13,060 packages for amd64 and 12,907 for 64-bit Arm. Highlights include Firefox 157.0, Chromium 154, GCC 16.1.0, Go 1.27.1, Python 3.14.7, Node.js 24.21.0 and PostgreSQL 18.6. The base system ships LLVM and Clang 22.1.6.

Existing systems upgrade from 7.9 using the project's upgrade guide, usually through the sysupgrade tool. The installer and package tools now handle the download mirror setting the same way, and the current directory was removed from pkg_add's default search path.

Windows apps may be next

Wine, the layer that runs Windows programs on Unix systems, has never been available on OpenBSD. That may change. On October 18, developer Thomas Frohwein proposed a Wine port on the openbsd-ports mailing list, crediting other contributors with most of the work. He wrote that several dozen 64-bit Windows applications ran, most of them successfully.

It is a proposal, not part of 8.0. "Biggest limitation is that WoW64 doesn't work, so 32bit Windows software is still a no-op," Frohwein wrote. WoW64 is the part of Wine that runs 32-bit programs, which recent Wine releases have been reworking.

What this means for developers

OpenBSD 8.0 is a security-first release, and its crypto defaults are worth copying even on other systems.

• Test post-quantum TLS now. Programs built on libtls will prefer the hybrid ML-KEM exchange. Check that load balancers and old clients between you and your users can handle the larger handshake.
• Upgrade firewalls with PF queues. If you shape traffic above 4 Gbps, the old queue limit is gone. Re-check your queue rules after the upgrade.
• Plan for loongson. That platform is gone, so loongson machines cannot move to 8.0. Budget for replacing them with another supported architecture.
• Use the new RISC-V support. The vector extension and new interrupt drivers make RISC-V boards a more serious OpenBSD target. Test your ports on them.
• Watch the Wine port. If you need 64-bit Windows tools on OpenBSD, follow the ports list. It is a draft, and the porter suggests running Wine as a separate unprivileged user for now.