ISC.org

ISC.org maintains and publishes the BIND 9 DNS software, the Kea DHCP server, and the Stork graphical management interface. ISC also operates the F-Root system for the benefit of the Internet.

Open Source: BIND 9 DNS, Kea DHCP, Stork
Services: F-Root operator, software support services
website: isc.org

Last Notes

2026-10-23 07:11:51 UTC

ISC has been fortunate to have @npub1amu…2lv5 as our Director of DNS Engineering since 2017. But independently of his day job, he is an important maintainer of PHP packages for Debian and Ubuntu.
This has become even more significant over the last few days as the PHP RCE vulnerabilities have been disclosed.
We are so proud of Ondřej, and grateful for him and all the other unsung heroes of the global Internet who work for the common good.
Read more at the Atlantic: https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/

2026-07-21 19:51:22 UTC

- reply

RE: https://hachyderm.io/@tonhe/116958179388960554
Yup. Dual-stack is a trap.

2026-07-21 18:58:44 UTC

We continue to get LLM reports of high severity security vulnerabilities in BIND 9 that turn out to be ... just the way the DNS works.
The *only possible conclusion* is, DNS is DANGEROUS.
Right?

2026-05-20 12:07:15 UTC

Our May 2026 maintenance releases of BIND 9 are available at https://isc.org/download : 9.18.49 and 9.20.23 (stable) and 9.21.22 (development). Packages and container images provided by ISC will be updated later today.
In addition to bug fixes and feature improvements, these releases also contain fixes for security vulnerabilities:
- https://kb.isc.org/docs/cve-2026-3039
- https://kb.isc.org/docs/cve-2026-3592
- https://kb.isc.org/docs/cve-2026-3593
- https://kb.isc.org/docs/cve-2026-5946
- https://kb.isc.org/docs/cve-2026-5947
- https://kb.isc.org/docs/cve-2026-5950

2026-04-28 22:07:46 UTC

RE: https://hachyderm.io/@mitsuhiko/116484406108247090
"This is also a good reminder that we rely so very much on the Internet Archive for many projects of the time."

2026-04-16 21:08:16 UTC

I just posted a blog, it is 100% nicer and more restrained than our development team would have posted. Read between the lines, people.... ;-)
https://www.isc.org/blogs/2026-04-16-How-to-report-a-vulnerability/

2025-12-22 14:42:16 UTC

When the European Commission approached us about funding a bug bounty for BIND 9, we were impressed with the proposal. We have a policy against bug bounties (because we were frustrated with people wasting our time), but under this proposal, the YesWeHack team would do initial triage, and use their expertise to minimize the 'slop' reports. This is a game-changer for a small development team.
The bounty program is active, and we are looking for our first valid report.
https://yeswehack.com/programs/bind-bug-bounty-program

2025-06-25 15:40:44 UTC

ISC is excited to announce the release of Kea 3.0.0! This is a major release, and is the first Long-Term Support (LTS) version of Kea.
There are MANY backward-incompatible changes in this new version, so we strongly encourage our users to READ THE RELEASE NOTES thoroughly before upgrading to Kea 3.0.0. The software and release notes can be downloaded from our website at https://www.isc.org/download/#Kea.
Thank you for using ISC’s software and we look forward to your feedback!

2025-05-28 19:48:56 UTC

Did you know that ISC has TWO job openings at the moment?
We are looking for two additional engineers for the Stork team. Stork is our powerful, scaleable, easy-to-use, open source, graphical management tool for DHCP and DNS.
These are both 100% remote, work-from-home jobs (from almost anywhere in the world) and ISC is a great place to work (even if we do say so ourselves).
If you're not a bot, please apply at https://isc.recruitee.com !
#FediHire #FediJob

2025-05-09 13:51:45 UTC

- reply

Some of you are looking for new jobs now, and I am very sympathetic to how hard that can be. However, this is also a terrible time to be hiring: we posted these jobs and immediately, AI-generated applications started flooding in. We are wasting a tremendous amount of time we don't have in wading through applications trying to decide if there is a human involved.
One of the reviewers commented that the hiring process may come down to who can correctly identify the traffic lights.

2025-05-07 14:35:28 UTC

ISC is hiring! We are looking for two additional engineers for the Stork team. We are developing a powerful, scaleable and easy to use Open Source graphical management tool for DHCP and DNS. These are both 100% remote, work from home jobs and ISC is a great place to work.
Apply at https://isc.recruitee.com

2025-03-10 19:09:35 UTC

RE: https://mastodon.rfc1925.org/@ondrej/114139634627242361
It would be nice if these people writing a new DNS resolver could just promote their system on its merits, without resorting to driveby attacks on existing software.
BIND9 has had many CVEs due to input validation and denial of service (due to our use of contracts), but memory safety has never been a significant cause of CVEs in BIND9. https://www.cvedetails.com/product/144/ISC-Bind.html?vendor_id=64

2024-12-10 00:07:00 UTC

Honestly you all are simply *LUCKY* that the internet works at all. If/when it works, it is because people who care are working, mostly un-noticed, in the background. I am not talking only of my own colleagues.....

2024-12-09 23:37:17 UTC

I have an idea for a new service, DNS *therapy*. We listen to your DNS problems with understanding and empathy, but we do not provide solutions. What do you think, is this a compelling offering??

2024-10-18 14:56:47 UTC

Do you have a successful open source project or projects that is ready for the next level, an organization to help sustain and govern the project and ecosystem? If so, the NSF may be willing to fund the creation of that organization.
https://new.nsf.gov/funding/opportunities/pose-pathways-enable-open-source-ecosystems
#OpenSource

2024-09-25 12:36:58 UTC

The NSF is accepting applications for significant-size grants (up to a maximum of $1,500,000 per project) "to address significant safety, security, and/or privacy vulnerabilities, both technical (e.g., vulnerabilities in code and side-channels) and socio-technical (e.g., supply chain, insider threats, and social engineering)." in Open Source Products.
https://new.nsf.gov/funding/opportunities/safe-ose-safety-security-privacy-open-source-ecosystems
#OpenSource #privacy

2024-08-28 20:13:45 UTC

ISC is hiring!
Do you have what it takes to provide support for users of our BIND 9 and Kea DHCP software?
The position is fully remote and members of underrepresented communities are encouraged to apply.
Check it out at https://isc.recruitee.com/o/support-engineer, or look at our open positions anytime at https://www.isc.org/careers/ !