27-Year-Old OpenBSD Vulnerability Exposes PPPoE Authentication Bypass A critical vulnerability in OpenBSD’s networking stack, present since 1999, has been disclosed, allowing attackers to bypass Password Authentication Protocol (PAP) entirely. The flaw resides in the sppp_pap_input() function within the sppp(4) subsystem, which handles synchronous PPP links used in PPPoE connectivity. The issue stems from improper handling of attacker-controlled length fields during credential validation. OpenBSD’s PAP logic trusted length values from incoming PAP frames, enabling authentication bypass if zero-length credentials were supplied. Additionally, oversized length values could trigger a kernel heap overread, exposing adjacent memory a risk introduced after a 2009 update replaced fixed-size buffers with dynamic allocations. Exploitation requires no valid credentials; an attacker operating a rogue PPPoE server within the same broadcast domain can impersonate a legitimate server. A proof-of-concept confirmed full session establishment, including IP configuration and ICMP communication. The vulnerable code originated from FreeBSD and traces back to a mid-1990s Cronyx Engineering implementation. Despite multiple updates, the flawed comparison logic remained unchanged for 27 years. The fix, disclosed responsibly on June 12, 2026, adds strict length-validation checks to reject zero-length and oversized inputs before comparison. OpenBSD patched the issue within two days. Organizations using OpenBSD in PPPoE environments are urged to apply the latest updates.

AI-Powered Cyber Threats Outpace Defenses as Anthropic’s Mythos Model Unleashes Unprecedented Exploits In April 2026, Anthropic released its advanced AI model, Mythos, to a limited group of twelve partners under a controlled preview deemed too dangerous for public release. Within just 14 days, the model generated 181 working Firefox exploits, dwarfing the previous state-of-the-art model’s output of two. It also uncovered thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old flaw in OpenBSD, an OS renowned for its security. Over 99% of these vulnerabilities remain unpatched in production environments. The incident underscores a broader shift: offensive cyber operations now move at machine speed. Earlier in 2026, AWS Threat Intelligence documented a single low-skill attacker leveraging AI to compromise 2,516 FortiGate devices across 106 countries in minutes, exploiting known CVEs and misconfigurations faster than defenders could respond. The window between vulnerability disclosure and exploitation has collapsed. In 2018, the median time from CVE publication to in-the-wild exploitation was 2.3 years; by 2026, it has shrunk to just 10 hours. This acceleration renders traditional vulnerability management assumptions obsolete every disclosed flaw is now a potential immediate threat, with exploits generated via simple prompts rather than specialized expertise. Defensive gaps are further exposed by organizational inefficiencies. While AI-driven attacks complete compromises in 73 seconds, human-led response workflows spanning SIEM alerts, manual SOAR playbooks, and cross-team ticketing stretch patching timelines to 24 hours or more. The bottleneck isn’t tooling but fragmented handoffs between teams, where delays accumulate in Slack messages, PDF reports, and approval queues. To counter this, security programs must prioritize three pillars of resilience: 1. Identify – Comprehensive visibility across networks, endpoints, and cloud environments, with aggressive attack surface management to eliminate blind spots. 2. Protect – Tightly tuned controls focused on credential access, lateral movement, and privilege escalation, rather than generic vendor rules. 3. Validate – Continuous breach and attack simulation (BAS) and autonomous penetration testing to measure real-world exploitability, not just theoretical risk. Without validation, defensive AI becomes guesswork at scale. The Mythos incident reveals a stark reality: AI-driven offense has outpaced human-speed defense, leaving organizations vulnerable to exploits that emerge and spread before patches can be deployed. As boards now treat AI cyber risk as existential, security teams face pressure to adopt autonomous validation closing the gap between detection and remediation before attackers exploit it first.