Hosting Companies Rebooted EVERYTHING Because of This Bug
Read the Portuguese translation →
Author: Better Stack · Watch on YouTube
Video authored by the channel shown, not by IANIA; all rights belong to the creator. Transcript and summary generated automatically; the original-language content is preserved.
Original language: English
Original video: Hosting Companies Rebooted EVERYTHING Because of This Bug · Channel: Better Stack · 02:36 · Watch on YouTube
Topics: Cybersecurity and software security, AI infrastructure and hardware, Open source and software ecosystems
Summary
Section titled “Summary”A Linux networking bug allowed a virtual machine to manipulate a packet after the host had checked it, potentially leaking host memory and enabling root access. Researchers at pwn.ai found the sandbox escape in three days while working on Vercel’s challenge, and it was tracked as CVE-2026-9999 with a severity score of 9.3. After the fix became public, hosting providers scrambled to patch their hosts, with some performing emergency reboots. The patch must be installed on the host kernel; updating guest VMs alone does not fix the issue.
Key points
Section titled “Key points”- Vercel launched a $1 million challenge in August to test its sandbox product.
- Researchers at pwn.ai found a way out of the sandbox in three days, with human researchers steering the work and GPT-5.6 Soul assisting with code analysis.
- The vulnerability, called Pawn Escape or Own Escape, is tracked as CVE-2026-9999 and has a severity score of 9.3 out of 10.
- The bug was in Linux networking code on the host, not in the hypervisor, and dates back to Linux 2.6.27 from 2008.
- A guest could alter part of a network packet after the host had checked it, leading to a memory leak and, in the researchers’ lab, root access on the host.
- The fix was merged on October 14, and the write-up became public the next day, triggering emergency maintenance at hosting providers.
- Fly.io performed platform-wide rolling host reboots lasting almost 33 hours; Freak Hosting reported that 98 of its 99 hypervisors were patched.
- AWS said EC2, Lambda, and Fargate were not affected; patched kernels were available for stable branches from 5.10 through 7.2.
- The fix must be applied to the host itself; guest VM updates do not resolve the vulnerability.
- Operators of their own KVM hosts should check that the kernel includes the fix and reboot into it.
Chapters
Section titled “Chapters”| Start | Chapter | Summary |
|---|---|---|
| 00:00 | A sandbox escape found in a challenge | Researchers at pwn.ai found a way out of Vercel’s sandbox challenge in three days, with the bug later tracked as CVE-2026-9999. |
| 00:31 | A Linux networking bug beneath the hypervisor | The vulnerability was in host Linux networking code dating back to 2008 and let a guest alter a packet after it had been checked. |
| 01:03 | From memory leak to emergency reboots | The researchers demonstrated root access on a host, and publication of the fix led hosting providers to begin emergency maintenance. |
| 01:34 | Providers patch their hosts | Providers including fly.io and Freak Hosting reported patching hypervisors, while AWS said several services were unaffected. |
| 02:05 | What operators need to update | The fix must be installed on the host kernel, and operators running their own KVM hosts should check for the patch and reboot. |
Quotes
Section titled “Quotes”one Linux bug that lets a virtual machine break out and take over the machine it’s running on. — 00:00
this bug lives in the Linux networking code on the host — 00:31
fly.io ran platform-wide rolling host reboots that lasted almost 33 hours — 01:34
the patch has to go on the host itself because updating your guest VMs won’t fix anything. — 02:05
every part of the host that the guest can talk to is a part that can be exploited. — 02:36
Concepts and entities
Section titled “Concepts and entities”Vercel, pwn.ai, GPT-5.6 Soul, CVE-2026-9999, Linux, KVM, fly.io, AWS, KernelCare
Full transcript (original language)
Section titled “Full transcript (original language)”00:00 Well, folks, last weekend thousands of engineers at hosting companies around the world had to drop everything and reboot their servers all because of one Linux bug that lets a virtual machine break out and take over the machine it’s running on. Let me explain. So, back in August, Vercel launched a $1 million challenge inviting researchers to break out of its sandbox product. And a team at pwn.ai, I guess that is pronounced own.ai, took it on and with human researchers steering the work and GPT-5.6 Soul helping with the code analysis, they found a way out of the sandbox in just 3 days. They called it
00:31 Pawn Escape or Own Escape, I guess, and it’s now tracked as CVE-2026-9999 with a severity score of 9.3 out of 10. The surprising part is where the bug was hiding. So, when we think about VM security, we usually think about the hypervisor, which is the software that keeps virtual machines walled off from each other. But, this bug lives in the Linux networking code on the host, and it goes all the way back to Linux 2.6.27 from 2008. In simple terms, a virtual machine can send the host a specially crafted network packet. The host checks
01:03 that packet and decides it’s safe, but a delayed step later on lets the guest change part of that packet after the check has already happened. That tricks the host into leaking pieces of its own memory, and in their own lab, the researchers turned that leak into a full root access on the host machine. And that’s a big deal because the entire cloud is built on the promise that your VM cannot touch the server underneath it or the other customers VMs sharing the same server. The fix was merged into machine Linux on October 14th, and the write-up went public the next day, which was a Thursday, and that’s when the
01:34 scramble started. Paul Yebelo, the researcher behind it, posted a collage of status pages from hosting providers all dealing with it at the same time. A lot of them had to announce emergency maintenance. fly.io ran platform-wide rolling host reboots that lasted almost 33 hours, and a smaller provider called Freak Hosting reported that 98 of its 99 hypervisors were patched with one still left to go. Not everyone got hit though. AWS says EC2, Lambda, and Fargate aren’t affected. And patched kernels are out for every stable branch from 5.10 up to
02:05 7.2. And distributions like Debian, Ubuntu, and RHEL are rolling the fix into their kernels. The most important thing to remember is that the patch has to go on the host itself because updating your guest VMs won’t fix anything. And for anyone who can’t afford a reboot, companies like TuxCare are shipping live patches through KernelCare. So, if you’re renting a VPS, your provider has most likely handled this already. But if you run your own KVM hosts with VMs you don’t fully trust, check that your kernel includes the fix and reboot into it as soon as you can. I guess the bigger lesson here
02:36 is that keeping a VM inside its box depends on a lot more than the hypervisor because every part of the host that the guest can talk to is a part that can be exploited. If you want to stay up-to-date with the latest in security and engineering, be sure to subscribe to the Better Stack channel.