Claude Mythos Preview is finding old vulns. Like this one.
“And it autonomously wrote a remote code execution exploit on FreeBSD’s NFS server that granted full root access to unauthenticated users by splitting a 20-gadget ROP chain over multiple packets.”
That means CORE (and by extension zVault) may be cooked for any use case that involves NFS. While FreeBSD has patched this vuln, it has done so in 13.5 and above. CORE is on 13.0 (mostly) and 13.3 (vanishingly few) and EOL; and the zVault devs are taking an extended break with no sign of coming back, and have not upgraded zVault to 13.5.
The fix could be back-ported to 13.0 / 13.3 no doubt: But I do doubt that CORE is sufficiently important still that it will be.
https://www.freebsd.org/security/advisories/FreeBSD-SA-26:08.rpcsec_gss.asc