https://blog.kalfaoglu.net/tags/smtp/Recent content in Smtp on kalfaoglu.netHugoenWed, 02 Sep 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-09-02-postfix-3116-security-audit-en/Wed, 02 Sep 2026 00:00:00 +0000https://blog.kalfaoglu.net/posts/2026-09-02-postfix-3116-security-audit-en/<p>On August 10, 2026, Wietse Venema released <a href="https://www.postfix.org/announcements/postfix-3.11.6.html">Postfix 3.11.6</a>, along with coordinated updates for six legacy branches: 3.10.13, 3.9.14, 3.8.20, 3.7.22, 3.6.20, and 3.5.27. If you run mail on Linux, you almost certainly run Postfix. You should update.</p> <p>The release is unusual for two reasons: the scope of what was found, and how it was found.</p> <h2 id="how-the-bugs-were-discovered">How the bugs were discovered</h2> <p><a href="https://www.qualys.com/">Qualys</a>, working with <a href="https://www.anthropic.com/">Anthropic&rsquo;s Claude Mythos Preview</a>, and separately <a href="https://openai.com/security/">OpenAI Security</a>, ran an AI-assisted audit of the Postfix codebase — over 150,000 lines of C accumulated across nearly three decades of single-developer maintenance. The results were, to put it charitably, humbling. More than half of the discovered defects date from 20 or more years ago. The oldest traces back to before Postfix&rsquo;s first public alpha release in April 1997.</p>