Postfix 3.11.6: The Audit That Dug Up 30 Years of Bugs
On August 10, 2026, Wietse Venema released Postfix 3.11.6, along with coordinated updates for six legacy branches: 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, and 3.5.27. If you run mail on Linux, you almost certainly run Postfix. You should update. The release is unusual for two reasons: the scope of what was found, and how it was found. How the bugs were discovered Qualys, working with Anthropic’s Claude Mythos Preview, and separately OpenAI Security, ran an AI-assisted audit of the Postfix codebase — over 150,000 lines of C accumulated across nearly three decades of single-developer maintenance. The results were, to put it charitably, humbling. More than half of the discovered defects date from 20 or more years ago. The oldest traces back to before Postfix’s first public alpha release in April 1997. ...