Note: they explicitly state &quot;only two <i>remote</i> holes...&quot;, one of which can be found in this very thread.<p>Security problems are usually clearly marked in the changelog: <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata59.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata59.html</a><p>What really annoys me with OpenBSD is that users are expected to download the CVS source and compile it to fix problems rather than upgrade to a dot-release.<p>For a normal user that&#x27;s fine, but if you have a bunch of servers you&#x27;ll need a sophisticated build&#x2F;deploy infrastructure to stay updated.