{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999) · updates",
  "home_page_url": "https://pwn.watch/i/pwnescape-cve-2026-99999",
  "feed_url": "https://pwn.watch/i/pwnescape-cve-2026-99999/feed.json",
  "description": "Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops. Fly.io published an Oct 16 2026 postmortem of a ~10-hour fleet-wide host reboot after the CVE, saying customer data exposure was unlikely but advising rotation of credentials sent over HTTP or unencrypted 6PN between Oct 15 and 17.",
  "language": "en",
  "_pwn": {
    "slug": "pwnescape-cve-2026-99999",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/pwnescape-cve-2026-99999/feed.xml",
    "llms": "https://pwn.watch/i/pwnescape-cve-2026-99999/llms.txt",
    "json": "https://pwn.watch/i/pwnescape-cve-2026-99999.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-11-06-a7a4a940",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-11-06-a7a4a940",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Hacker News discusses Fly.io's PwnEscape postmortem (Well, That Wasn't Fun).",
      "content_text": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Hacker News discusses Fly.io's PwnEscape postmortem (Well, That Wasn't Fun).\n\nSource: https://news.ycombinator.com/item?id=50397310",
      "date_published": "2026-11-06T00:00:00.000Z",
      "external_url": "https://news.ycombinator.com/item?id=50397310",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-16-809e1ee4",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-16-809e1ee4",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Fly.io begins an emergency fleet-wide host reboot for CVE-2026-99999 (PwnEscape), completing the patched-kernel rollout in about 10 hours; later postmortem says customer data exposure was unlikely but advises rotating credentials sent over HTTP or unencrypted 6PN Oct 15–17.",
      "content_text": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Fly.io begins an emergency fleet-wide host reboot for CVE-2026-99999 (PwnEscape), completing the patched-kernel rollout in about 10 hours; later postmortem says customer data exposure was unlikely but advises rotating credentials sent over HTTP or unencrypted 6PN Oct 15–17.\n\nSource: https://fly.io/blog/well-that-wasnt-fun/",
      "date_published": "2026-10-16T00:00:00.000Z",
      "external_url": "https://fly.io/blog/well-that-wasnt-fun/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-14-f2d6c8e7",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-14-f2d6c8e7",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Mainline merge / public write-ups.",
      "content_text": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Mainline merge / public write-ups.",
      "date_published": "2026-10-14T00:00:00.000Z",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-07-077badd6",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-10-07-077badd6",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Upstream IPv4 checksum guard accepted into net.git.",
      "content_text": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Upstream IPv4 checksum guard accepted into net.git.",
      "date_published": "2026-10-07T00:00:00.000Z",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-08-20-916282cf",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-08-20-916282cf",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Initial host-memory disclosure reported.",
      "content_text": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Initial host-memory disclosure reported.",
      "date_published": "2026-08-20T00:00:00.000Z",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-08-18-db4d8d8c",
      "url": "https://pwn.watch/i/pwnescape-cve-2026-99999#2026-08-18-db4d8d8c",
      "title": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Vercel Sandbox challenge opens.",
      "content_text": "PwnEscape: Linux networking guest-to-host escape (CVE-2026-99999): Vercel Sandbox challenge opens.",
      "date_published": "2026-08-18T00:00:00.000Z",
      "tags": [
        "critical"
      ]
    }
  ]
}