[ixpmanager] Context on recent security releases of IXP Manager

[Barry O'Donovan (INEX)]

Hi all,

With the release of version 7.4.1 today, you will have noticed that our 
last six releases have either included security fixes or have been 
primarily security-related.

We wanted to step back from the individual release notes and provide 
some context on why these disclosures are happening now, what is driving 
them, and why this is ultimately a significant positive for the 
platform’s security.

What is driving the recent disclosures?

In the first instance, our team proactively engaged in an ENISA-funded 
grey-box testing program. We then took learnings from this and applied 
them to the wider codebase.

Then, over the past few months, independent security researchers have 
turned their attention to IXP Manager. When we asked the reporters why 
they chose our platform and how they approached it, their responses 
summarised the current landscape quite well.

One told us they chose IXP Manager as a research target because it is 
open-source and widely deployed for managing internet exchange 
infrastructure. They also said they did the work in a lab environment 
using a source-assisted methodology with AI-assisted tooling.

Another told us that they were a cybersecurity student developing a 
multi-agent code-auditing agent, inspired by MDASH’s technical approach, 
with DeepSeek V4.1 Flash. They chose IXP Manager as a real-world 
open-source codebase.

Crucially, none of these issues stems from active exploitation or 
incidents in the wild; they are entirely the result of deliberate, 
coordinated vulnerability research.

Why this is good for IXP Manager

Every report we have received has arrived through coordinated, 
responsible disclosure. Researchers have provided detailed 
proofs-of-concept, worked with us to verify fixes, and all agreed to 
hold disclosure of additional details until at least 30 days after 
patched versions were released.

One of the reasons we are sending this email is that we realise that a 
string of security advisories can look concerning on the surface, but 
what is actually happening is a trend emerging across the entire 
software ecosystem: the impact of modern, AI-assisted vulnerability 
discovery.

The application of AI to cyber-security is driving rapid discovery of 
security issues across the spectrum. From our perspective, this is, in 
turn, driving intense and comprehensive hardening of the IXP Manager 
codebase. Having modern static and dynamic testing methods applied to 
our code - at no cost to the project - makes the platform substantially 
more resilient.

Looking ahead

We are deeply grateful to the researchers working with us to responsibly 
disclose the issues they find, validate our fixes, and agree to our 
disclosure timeline requests.

While triaging and addressing security disclosures is time-consuming, we 
will always prioritise addressing security issues. We also incorporate 
the patterns identified in these reports into our own internal reviews 
and CI processes, including regression tests, to prevent similar classes 
of bugs from re-emerging.

Thank you all for your ongoing support, and especially your patience 
with the release cadence, which we know creates work for all of you too.

Kind regards,
Barry O’Donovan
INEX

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20260928/5e280595/attachment.htm>