<div dir="ltr"><div>Hi Barry,</div><div><br></div><div>Thank you for putting the events into context.</div><div>I acknowledge that receiving news of fixed security issues is positive. To me it's a positive sign of liveliness -- at least in today's world.</div><div>It's good to see that (young) security researchers realize the value in IXP (management platforms).</div><div><br></div><div>So after all, thanks for giving us new versions of IXP manager to spend our time on.</div><div><br></div><div>Best wishes,</div><div>André</div><div><br></div><div>PS: Luckily we are not affected by the Ciritical issue.</div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Mon, 28 Sept 2026 at 17:40, Barry O'Donovan (INEX) via ixpmanager <<a href="mailto:ixpmanager@inex.ie">ixpmanager@inex.ie</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-7052749308730817218">
<div style="color:rgb(0,0,0)"><div id="m_-7052749308730817218magicdomid1656"><span>Hi all,</span></div><div id="m_-7052749308730817218magicdomid1659"><span><br></span></div><div id="m_-7052749308730817218magicdomid1659"><span>With the release of version 7.4.1 today, you will have noticed that our last six releases have either included security fixes or have been primarily security-related. </span></div><div id="m_-7052749308730817218magicdomid1661"><span><br></span></div><div id="m_-7052749308730817218magicdomid1661"><span>We wanted to step back from the individual release notes and provide some context on why these disclosures are happening now, what is driving them, and why this is ultimately a significant positive for the platform’s security.</span></div><div id="m_-7052749308730817218magicdomid1663"><b style="font-size:10.5pt"><br></b></div><div id="m_-7052749308730817218magicdomid1663"><b style="font-size:10.5pt">What is driving the recent disclosures?</b></div><div id="m_-7052749308730817218magicdomid1664"><span><br></span></div><div id="m_-7052749308730817218magicdomid1664"><span>In the first instance, our team proactively engaged in an ENISA-funded grey-box testing program. We then took learnings from this and applied them to the wider codebase.</span></div><div id="m_-7052749308730817218magicdomid1666"><span><br></span></div><div id="m_-7052749308730817218magicdomid1666"><span>Then, over the past few months, independent security researchers have turned their attention to IXP Manager. When we asked the reporters why they chose our platform and how they approached it, their responses summarised the current landscape quite well. </span></div><div id="m_-7052749308730817218magicdomid1668"><span><br></span></div><div id="m_-7052749308730817218magicdomid1668"><span>One told us they chose IXP Manager as a research target because it is open-source and widely deployed for managing internet exchange infrastructure. They also said they did the work in a lab environment using a source-assisted methodology with AI-assisted tooling.</span></div><div id="m_-7052749308730817218magicdomid1670"><span><br></span></div><div id="m_-7052749308730817218magicdomid1670"><span>Another told us that they were a cybersecurity student developing a multi-agent code-auditing agent, inspired by MDASH’s technical approach, with DeepSeek V4.1 Flash. They chose IXP Manager as a real-world open-source codebase.</span></div><div id="m_-7052749308730817218magicdomid1672"><span><br></span></div><div id="m_-7052749308730817218magicdomid1672"><span>Crucially, none of these issues stems from active exploitation or incidents in the wild; they are entirely the result of deliberate, coordinated vulnerability research.</span></div><div id="m_-7052749308730817218magicdomid1675"><b style="font-size:10.5pt"><br></b></div><div id="m_-7052749308730817218magicdomid1675"><b style="font-size:10.5pt">Why this is good for IXP Manager</b></div><div id="m_-7052749308730817218magicdomid1709"><span><b><br></b></span></div><div id="m_-7052749308730817218magicdomid1678"><span>Every report we have received has arrived through coordinated, responsible disclosure. Researchers have provided detailed proofs-of-concept, worked with us to verify fixes, and all agreed to hold disclosure of additional details until at least 30 days after patched versions were released.</span></div><div id="m_-7052749308730817218magicdomid1679"><br></div><div id="m_-7052749308730817218magicdomid1704"><span>One of the reasons we are sending this email is that we realise that a string of security advisories can look concerning on the surface, but what is actually happening is a trend emerging across the entire software ecosystem: the impact of modern, AI-assisted vulnerability discovery.</span></div><div id="m_-7052749308730817218magicdomid1681"><span> </span></div><div id="m_-7052749308730817218magicdomid1682"><span>The application of AI to cyber-security is driving rapid discovery of security issues across the spectrum. From our perspective, this is, in turn, driving intense and comprehensive hardening of the IXP Manager codebase. Having modern static and dynamic testing methods applied to our code - at no cost to the project - makes the platform substantially more resilient.</span></div><div id="m_-7052749308730817218magicdomid1682"><b style="font-size:10.5pt"><br></b></div><div id="m_-7052749308730817218magicdomid1682"><b style="font-size:10.5pt">Looking ahead</b></div><div id="m_-7052749308730817218magicdomid1685"><span><br></span></div><div id="m_-7052749308730817218magicdomid1685"><span>We are deeply grateful to the researchers working with us to responsibly disclose the issues they find, validate our fixes, and agree to our disclosure timeline requests.</span></div><div id="m_-7052749308730817218magicdomid1687"><span style="font-size:10.5pt"><br></span></div><div id="m_-7052749308730817218magicdomid1687"><span style="font-size:10.5pt">While triaging and addressing security disclosures is time-consuming, we will always prioritise addressing security issues. We also incorporate the patterns identified in these reports into our own internal reviews and CI processes, including </span><span>regression tests,</span><span> to prevent similar classes of bugs from re-emerging.</span></div><div id="m_-7052749308730817218magicdomid1689"><span><br></span></div><div id="m_-7052749308730817218magicdomid1689"><span>Thank you all for your ongoing support, and especially your patience with the release cadence, which we know creates work for all of you too.</span></div><div id="m_-7052749308730817218magicdomid1690"><span><br></span></div><div id="m_-7052749308730817218magicdomid1692"><span>Kind regards,</span></div><div id="m_-7052749308730817218magicdomid1693"><span>Barry O’Donovan</span></div><div id="m_-7052749308730817218magicdomid1693"><span>INEX</span></div><div id="m_-7052749308730817218magicdomid1694"><br></div><div id="m_-7052749308730817218magicdomid1696"><span> </span></div></div>_______________________________________________<br>
INEX IXP Manager mailing list<br>
<a href="mailto:ixpmanager@inex.ie" target="_blank">ixpmanager@inex.ie</a><br>
Unsubscribe or change options here: <a href="https://www.inex.ie/mailman/listinfo/ixpmanager" rel="noreferrer" target="_blank">https://www.inex.ie/mailman/listinfo/ixpmanager</a><br>
</div></blockquote></div><div><br clear="all"></div><br><span class="gmail_signature_prefix">-- </span><br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">André Grüneberg, Managing Director<br><a href="mailto:andre.grueneberg@bcix.de" target="_blank">andre.grueneberg@bcix.de</a></div><div dir="ltr">+49 30 2332195 42<br><p>BCIX Management GmbH<br>Albrechtstr. 110<br>12103 Berlin<br>Germany</p><p>Geschäftsführer/Managing Directors: Jens Lietzmann, André Grüneberg<br>Handelsregister: Amtsgericht Charlottenburg, HRB 143581 B</p><font size="1"><span style="font-family:Calibri,"sans-serif"" lang="EN-US"></span></font></div></div></div></div></div></div></div></div></div></div>