On April 29, 1981, two DECSYSTEM-20s at Columbia University traded their first bytes over a plain null-modem cable. On August 3, 2026, the protocol born in that moment shipped version 11. Between those dates: forty-five years, three homes and one frog.
C-Kermit 11 (11.0.506) is the first stable release since 2011; everything that shipped in between, after 9.0.302, carried a beta label16. The announcement opens with a dedication you rarely see in a changelog: "Frank was directly involved with Kermit for 44 years, from its initial design in 1981 all the way through 2025," writes John Goerzen about Frank da Cruz, who co-created the protocol1.
One more release, you might say. Except this particular software still updates firmware, runs factory machines and talks to pocket calculators. Good enough reasons to pop the hood.
Two DECs and a cable
Kermit started as an inventory problem. In 1981, Columbia's computer center ran DEC and IBM mainframes side by side and was about to put CP/M "Superbrain" microcomputers into a public terminal room. None of these worlds shared a file format, or even a character set2.
The requirements came from Frank da Cruz, manager of the DEC-20s and Catchings' boss at the time: a robust, platform-independent protocol that could carry binary as well as text, even over bad lines. Catchings worked out the protocol, then wrote the first two implementations, one for the DEC-20 and one for CP/M. On April 29, 1981, two DECSYSTEM-20 Kermit instances transferred a file through a null-modem cable. A few weeks later came the first "real" transfer, between a DEC-20 and a Superbrain2.
The name arrived in May, facing the Muppets calendar on the wall. By da Cruz's own account, nobody in the group expected the software to leave the university, let alone last for decades3.
Built for bad lines
The original constraints explain almost everything after them. Packets under 100 bytes, because some systems choked on longer bursts, plus printable encodings for links that were not 8-bit clean. Character-set conversion between ASCII and EBCDIC had to come along too, because IBM mainframes did not write files like anyone else23.
And every session opens by negotiating what each end can do. That single choice made the protocol extensible: long packets, sliding windows and streaming mode arrived years later without breaking old clients3. Today a packet can reach roughly 9 KB4.
That is what took Kermit where faster protocols refused to go. In 2002-2003, the CSLM-2 microgravity experiment aboard the International Space Station pulled its data off an embedded MS-DOS box onto a Windows laptop over RS-232 at 38,400 baud, using Kermit. The ZIN Technologies engineer behind it reports that a custom "3.16 Beta 12-NASA" build, adapted by Joe Doupnik to run headless, was delivered within days5. According to the project's own documentation, the protocol also runs factory equipment, including a tape layer that forms structural parts of the Boeing 7873.
Three homes
From 1984 on, Columbia required the project to fund itself. By da Cruz's published accounts, it brought the university $8.89 million; Kermit 95, the only strictly commercial piece, sold more than a quarter million bulk-license seats alone3.
On July 1, 2011, Columbia canceled the project. All the software went under a BSD-style open source license, and the site moved to the Panix host. Da Cruz, laid off that same year as the last remaining member, kept going alone and unpaid23.
In 2025 he retired from the protocol after 44 years. Nothing had been released since4. The next era grew out of a very concrete frustration: John Goerzen, Debian's Kermit maintainer, was spending his time passing security patches to distributions by hand, and it was becoming unmanageable. He created Open Kermit, the protocol's third home, with a GitHub repository and proper documentation47.
Bug archaeology
Before changing anything, Goerzen built safety nets: C unit tests, a Python regression suite, more than 1,700 cases running continuously on Linux, macOS, FreeBSD and NetBSD. And one detail that sums up the whole effort, compatibility tests against gkermit, E-Kermit and C-Kermit 9.0.302 from 20111. Software that claims to talk to everything should verify it still talks to its own past.
The findings read like a core sample. A data-corruption bug caused by misusing strlen(), introduced in 1992 in C-Kermit 5A(188), has just been fixed1. A transfer hang dated back to Beta.05 of 20221. Pseudoterminal problems on macOS had lingered for decades1. And NetBSD wins the prize for strangest: its kernel can report writing more bytes to a pty than actually went through. In default mode, C-Kermit now detects the loss and shrinks its packet size on its own to compensate1.
Despite the additions (IPv6 with graceful IPv4 fallback, OpenSSL 3.x and 4.x support, serial speeds up to 4 Mbps, static musl binaries for amd64 and arm64, Android support), the codebase comes out about 2,600 lines shorter than the last 10.x beta. In plain terms: the dead code removed outweighed the features added1.
Defaults catch up
Version 11 also retires aged defaults, listing them honestly among the "rarely if ever" felt behavior changes1. The headline fix carries a number: CVE-2025-68920. Historical settings allowed a malicious remote Kermit server to perform actions on your local machine1. File collision handling moves from BACKUP to REJECT: previously, a hostile server could overwrite sensitive local files, .bashrc included1. Automatic transfer mode, which guessed text versus binary from file extensions and has already caused data loss, is now off by default1. And receiving a file whose name you never explicitly requested now asks for confirmation first1.
My reading: a protocol designed for institutional serial links assumed polite counterparts. The world of 2026 is not always polite, and the fix went into default values rather than into the protocol itself. Old habits remain available: launching the binary as kermit9 or kermit10 restores the previous settings1.
In his dedication, Goerzen writes that Kermit "glued systems together, from the International Space Station to pocket calculators"1. The line still stands, and the new compatibility suite takes it literally: the 2026 release against the 2011 one, on the same cable.