[ixpmanager] Context on recent security releases of IXP Manager

[André Grüneberg]

Hi Barry,

Thank you for putting the events into context.
I acknowledge that receiving news of fixed security issues is positive. To
me it's a positive sign of liveliness -- at least in today's world.
It's good to see that (young) security researchers realize the value in IXP
(management platforms).

So after all, thanks for giving us new versions of IXP manager to spend our
time on.

Best wishes,
André

PS: Luckily we are not affected by the Ciritical issue.

On Mon, 28 Sept 2026 at 17:40, Barry O'Donovan (INEX) via ixpmanager <
ixpmanager at inex.ie> wrote:

> Hi all,
>
> With the release of version 7.4.1 today, you will have noticed that our
> last six releases have either included security fixes or have been
> primarily security-related.
>
> We wanted to step back from the individual release notes and provide some
> context on why these disclosures are happening now, what is driving them,
> and why this is ultimately a significant positive for the platform’s
> security.
>
> *What is driving the recent disclosures?*
>
> In the first instance, our team proactively engaged in an ENISA-funded
> grey-box testing program. We then took learnings from this and applied them
> to the wider codebase.
>
> Then, over the past few months, independent security researchers have
> turned their attention to IXP Manager. When we asked the reporters why they
> chose our platform and how they approached it, their responses summarised
> the current landscape quite well.
>
> One told us they chose IXP Manager as a research target because it is
> open-source and widely deployed for managing internet exchange
> infrastructure. They also said they did the work in a lab environment using
> a source-assisted methodology with AI-assisted tooling.
>
> Another told us that they were a cybersecurity student developing a
> multi-agent code-auditing agent, inspired by MDASH’s technical approach,
> with DeepSeek V4.1 Flash. They chose IXP Manager as a real-world
> open-source codebase.
>
> Crucially, none of these issues stems from active exploitation or
> incidents in the wild; they are entirely the result of deliberate,
> coordinated vulnerability research.
>
> *Why this is good for IXP Manager*
>
> Every report we have received has arrived through coordinated, responsible
> disclosure. Researchers have provided detailed proofs-of-concept, worked
> with us to verify fixes, and all agreed to hold disclosure of additional
> details until at least 30 days after patched versions were released.
>
> One of the reasons we are sending this email is that we realise that a
> string of security advisories can look concerning on the surface, but what
> is actually happening is a trend emerging across the entire software
> ecosystem: the impact of modern, AI-assisted vulnerability discovery.
>
> The application of AI to cyber-security is driving rapid discovery of
> security issues across the spectrum. From our perspective, this is, in
> turn, driving intense and comprehensive hardening of the IXP Manager
> codebase. Having modern static and dynamic testing methods applied to our
> code - at no cost to the project - makes the platform substantially more
> resilient.
>
> *Looking ahead*
>
> We are deeply grateful to the researchers working with us to responsibly
> disclose the issues they find, validate our fixes, and agree to our
> disclosure timeline requests.
>
> While triaging and addressing security disclosures is time-consuming, we
> will always prioritise addressing security issues. We also incorporate the
> patterns identified in these reports into our own internal reviews and CI
> processes, including regression tests, to prevent similar classes of bugs
> from re-emerging.
>
> Thank you all for your ongoing support, and especially your patience with
> the release cadence, which we know creates work for all of you too.
>
> Kind regards,
> Barry O’Donovan
> INEX
>
>
> _______________________________________________
> INEX IXP Manager mailing list
> ixpmanager at inex.ie
> Unsubscribe or change options here:
> https://www.inex.ie/mailman/listinfo/ixpmanager
>


-- 
André Grüneberg, Managing Director
andre.grueneberg at bcix.de
+49 30 2332195 42

BCIX Management GmbH
Albrechtstr. 110
12103 Berlin
Germany

Geschäftsführer/Managing Directors: Jens Lietzmann, André Grüneberg
Handelsregister: Amtsgericht Charlottenburg, HRB 143581 B
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://www.inex.ie/pipermail/ixpmanager/attachments/20260929/c3af52da/attachment-0001.htm>