Among the reported findings from the programme filed at 26-0404 are a 27-year-old vulnerability in OpenBSD and a 16-year-old bug in FFmpeg. Both are described as having survived every prior round of human code review and automated testing.
OpenBSD in particular is a project whose reputation rests on code auditing. If a defect can persist there for 27 years, the finding is about the limits of review rather than about that project.
Two Things This Does Not Mean
It does not mean the software was insecure for 27 years in any practical sense. A defect nobody had found was not being exploited, and the security a project delivered over that period was real.
It also does not mean human review is worthless. Review catches an enormous volume of defects before release; what it evidently does not catch reliably is a particular class that requires holding more context than a reviewer can.
What It Does Mean Is Uncomfortable
Age is not evidence of correctness. "Battle-tested" and "mature" are used as security arguments in dependency selection, and this finding undercuts them: a component may have been examined by thousands of people for decades and still contain an exploitable defect that nobody had the technique to find.
The corollary is that every long-lived codebase should now be assumed to contain findings of this kind, whether or not anyone has looked yet.
Who Else Can Look
The capability that found these is available to anyone who can pay for compute. There is no property of it that restricts use to a disclosure programme, which is the concern filed at 26-0315.
A defect that survived 27 years of review is exactly the category an adversary would most value: present in an enormous deployed base, with no patch, and no reason for anybody to be watching for its exploitation.
Compiled from published reporting on the coalition’s findings, listed below. Ages and characterisations are as reported; we have not examined the defects. Corrections: corrections@forensicpost.com.