Security maintenance completed: CVE-2026-99999
Scheduled security maintenance is complete. Kernel updates for CVE-2026-99999 are active, affected cloud servers have restarted, and platform services have passed recovery checks.
We have completed the scheduled security maintenance for CVE-2026-99999. The kernel security update is now active, affected cloud servers have restarted, and platform services have passed recovery checks.
Thank you for your patience during the maintenance window.
Why this update was needed
CVE-2026-99999 is a Linux kernel vulnerability that can allow a malicious virtual machine to compromise its host through the virtual networking stack. We applied the upstream security update and restarted the affected infrastructure to activate the fixed kernel.
Maintenance timeline
All times below are in UTC on October 19, 2026.
- 16:00: The scheduled maintenance window began.
- 16:02: The infrastructure restart was initiated after pre-maintenance checks.
- 16:08: Cloud servers that had been running before maintenance had restarted.
- 16:09: Website, API, background worker, and database recovery checks passed. Object storage had also passed its recovery checks.
- 16:11: Final infrastructure and service verification was completed.
Service impact
Affected cloud servers restarted during the maintenance window. The control panel, API, and LAX object storage experienced temporary interruptions while the infrastructure and services restarted.
Cloud servers that were powered off before maintenance were kept powered off.
What we verified
- The updated kernel was running after the restart, making the security fix active.
- Virtualization services, storage, and infrastructure health checks passed.
- Cloud server power states matched their pre-maintenance states.
- The website, API, background worker, and database passed health checks.
- Object storage services were healthy, and the public S3 endpoint responded as expected.
These checks cover infrastructure and platform services. They do not verify every application running inside customer cloud servers.
What customers should do
No additional customer-initiated reboot is required for this host-level security update. Please check that your applications and scheduled jobs have resumed as expected.
If your server remains unreachable or a service has not recovered, please contact support with your server ID or affected service details. You can also check the status page for service updates.
References
This notice is based on our maintenance records and the checks completed after the restart. For technical details about the vulnerability and upstream fixes, see: