[Tiberium]

Seems to be found as a part of Patch The Planet [0] which is basically OpenAI giving model access and Trail of Bits using them to find vulnerabilities in OSS projects.

[0] https://openai.com/index/patch-the-planet/

[TacticalCoder]

Sidenote but... I read this on that link:

dnsmasq: Codex Security independently identified vulnerable patterns corresponding to four of the six dnsmasq CVEs later fixed in 2.92rel2: CVE-2026-4890 (opens in a new window), CVE-2026-4891 (opens in a new window), CVE-2026-4892 (opens in a new window), and CVE-2026-517

dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines.

[1vuio0pswjnm7]

"dnsmasq has had so many freaking security holes in 2025 and 2026 that atm I decided to just remove that thing from all my machines."

Would be nice if OpenWRT would stop including it by default

[CursedSilicon]

What else is out there that fits openWRT's use case? BIND seems like it would be a bit "heavy"

[toast0]

For caching recursive dns, unbound?

I got the feeling that dnsmasq does more than just recursive dns though?

[dfc]

I think that is the "challenge" with dnsmasq. In addition to caching DNS it also does, dhcp, authoritative DNS, BOOTP and TFTP.

[somat]

Unbound can do authoritative dns. It is a bit clunky so usually what you do is have NSD for the authoritative parts and unbound for the recursive parts. but unbound has local-zone: stub-zone: forward-zone: auth-zone: directives. I am not the most sophisticated dns admin but I am fairly sure that just unbound by itself can do almost any dns party trick you care to throw at it.

[Someone]

> Unbound can do authoritative dns

I don’t know whether they’re right, but https://www.openbsdhandbook.com/bind/ and https://www.openbsdhandbook.com/unbound/ disagree with that, saying you need the sublingual nsd for that.

[a96]

I wonder if people today remember BIND's history with security.

[1vuio0pswjnm7]

NB. "PiHole" is derived from dnsmasq

[nubinetwork]

I would love to, but apparently its needed for libvirt.

[khrbtxyz]

It is required mainly for VMs that use virbr0 and NAT. Networking options like macvtap don't need it.

[john_strinlai]

neat, i'm a big fan of trail of bits but apparently missed this announcement. here's their post: https://blog.trailofbits.com/2026/06/22/introducing-patch-th... and a summary of week 1: https://gist.github.com/patch-the-planet/69fd1aa925c8e73edea...