FreeBSD Released the Most Security Advisories in Project History in June 2026

On average, the FreeBSD security team releases about 2 security advisories per month. AI has changed this.

In April, the project released 8 advisories, with 6 powered by AI. In May, the count decreased slightly to 7.

Today I took a look at the FreeBSD Security Advisory page to check the latest advisory count.

June saw the most number of advisories ever published in project history: 25.

This blows away the previous record of 18 from January 2001. The other big spike was 11 in January 2016.

AI apaprently discovered at least 9 of the June 2026 FreeBSD vulnerabilities.

On 15 June the FreeBSD Foundation announced the FreeBSD AI-assisted Vulnerability Discovery Project:

“The 6-month project is being funded by a grant from the Alpha Omega project.

The funds will be used to engage FreeBSD Security Team members under fixed-term contracts to find and patch vulnerabilities.

The Security Team’s access to publicly available AI models and tokens will be provided free of charge. AI will be used for vulnerability discovery and analysis only, all patches will be manually created.”

Yes, 25 vulnerabilities is far lower than the 570 associated with Patch Tuesday this week. However, it’s important to see the effects of AI-powered vulnerability discovery everywhere. It’s not hype. It is real.

I am hopeful that developers will continue to use AI to discover and fix vulnerabilities in old code, and also prevent new code from shipping with vulnerabilities.

Addendum:

I asked Gemini to explain the large number of advisories in 2001-2002. It said:

“The
pronounced security advisory spike between August 2000 and January 2001
represents one of the most concentrated periods of security patching in
FreeBSD’s history, totaling 66 advisories in a six-month window.

A
closer look at the specific advisories reveals that this spike was
primarily driven by a massive wave of vulnerabilities discovered in
popular third-party software (the “Ports” collection) along with
critical auditing of core networking daemons.

1. Vulnerabilities in Popular Third-Party Software (Ports)

During
this era, many open-source projects were grappling with newly pervasive
exploitation techniques like buffer overflows and format string
vulnerabilities. The dataset shows a massive batch of updates for staple
utilities of the early-2000s internet:

Internet
& Chat Clients: Multiple advisories were issued for communication
tools, including the `pine` mail client, `xchat`, `gaim` (instant
messaging), `bitchx` (IRC client), and the `netscape` web browser.

Web
& Content Servers: Security flaws were patched in web servers and
frameworks like `php`, `zope`, `thttpd`, and the `boa` web server.

Development
& System Tools: Popular utilities like `curl`, `gnupg`, `cvsweb`,
`ethereal` (now Wireshark), `syslog-ng`, and even alternative
shells/editors like `bash1` and `joe` required immediate security
patches.

2. Core System & Network Infrastructure Patches

Alongside
user-facing applications, the core FreeBSD development team had to
address architectural and networking vulnerabilities in the base system:

Routing
& Firewalls: Critical flaws were patched in basic networking
security logic, notably `ipfw` (the firewall tool) and `ppp-nat`
(Network Address Translation).

Core
Network Daemons: High-risk vulnerabilities struck standard network
entry points, resulting in patches for `bind` (DNS server), `telnetd`,
`dhclient`, and the newly adopted `openssh`.

Protocol
& Kernel Level: Security advisories were issued for low-level
system components like `tcp-iss` (Initial Sequence Number generation,
crucial for preventing TCP hijacking) and filesystem-level wrappers like
`procfs`.

3. The Climax: January 2001

The
spike peaked dramatically in January 2001 alone with 18 advisories.
This was largely an administrative and security “housecleaning” event.
Rather than a single massive system failure, it reflects a coordinated
effort by the FreeBSD Security Officer team to bundle and ship security
patches for dozens of utilities simultaneously—including `crontab`,
`inetd`, `mysql`, and `xfree86`—ensuring systems were hardened as the
platform matured.”

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts