https://pwn.watch/t/firecracker Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 09:18:00 GMT https://pwn.watch/i/pwnescape-cve-2026-99999 https://pwn.watch/i/pwnescape-cve-2026-99999 Thu, 22 Oct 2026 09:18:00 GMT critical <p>Paulos Yibelo / pwn.ai found a Critical Linux networking flaw (CVE-2026-99999, CVSS 9.3) during Vercel’s $1M Sandbox challenge. Guest-controlled checksum metadata can rewrite an IPv4 header after validation, enabling host-memory disclosure and, in lab conditions, guest-to-host code execution on KVM/Firecracker. Upstream fix merged Oct 2026; host kernels need patch + reboot. Affects multi-tenant VPS / sandbox providers more than end-user desktops.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Upstream commit 6785011f8b16 and matching stable backports; vendor kernels as listed by distros</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-14/15: Mainline merge / public write-ups.</li><li>2026-10-07/08: Upstream IPv4 checksum guard accepted into net.git.</li><li>2026-08-20: Initial host-memory disclosure reported.</li></ul> <p><strong>CVEs:</strong> CVE-2026-99999</p>