Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidentsFull incident
LivePatchedPatch now

Day · Oct 16, 2026

PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999)

Linux kernel networking (host side of KVM/Firecracker and similar)

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Follow this incident

Updates on Oct 16, 2026

  1. Fly.io begins an emergency fleet-wide host reboot for CVE-2026-99999 (PwnEscape), completing the patched-kernel rollout in about 10 hours; later postmortem says customer data exposure was unlikely but advises rotating credentials sent over HTTP or unencrypted 6PN Oct 15–17.

Summary

Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops. Fly.io published an Oct 16 2026 postmortem of a ~10-hour fleet-wide host reboot after the CVE, saying customer data exposure was unlikely but advising rotation of credentials sent over HTTP or unencrypted 6PN between Oct 15 and 17.

Read the full incident →

Advisories1

Sponsored

Buy sponsor slot · $149/mo