Emergency security maintenance: CVE-2026-99999
What happened
On 15 October, a critical vulnerability in the Linux kernel was publicly disclosed (CVE-2026-99999, nicknamed “PwnEscape”, rated 9.3 out of 10 on the CVSS scale). Like a lot of organisations, WikiOasis runs its services as virtual machines: separate, isolated computers that share the same physical server.
When a virtual machine sends network traffic, it can ask the physical server to finish some checksumming on each packet. The server trusted the virtual machine’s instructions about where to write that result without checking them properly. By sending malicious packets, a malicious virtual machine could trick the server into overwriting part of the packet’s own header, which then caused the server to hand back small pieces of its own memory. The researchers who found it showed that this could be built up into full control of the physical server.
The vulnerability had been present in Linux since 2008 and was discovered during a public security challenge run by Vercel. It was reported privately to the Linux developers, fixed, and disclosed once patches were ready. Because it sits in Linux itself rather than in any one company’s setup, it affects almost everybody who uses virtualisation, which is why many providers have been carrying out emergency maintenance this week.
A patched kernel was released for our virtualisation platform, and we installed it on both of our physical servers. Applying a kernel update requires restarting the server, and because of how our infrastructure is currently orchestrated, the restarting briefly took the platform offline.
What you may have noticed
While we restarted our servers, WikiOasis was briefly unavailable. You may have seen a Cloudflare error page (error 521), or your browser may have unexpectedly downloaded an empty file instead of loading the page. We estimate approximately 20 minutes of downtime due to this.
Was my data affected?
We have no evidence that this vulnerability was exploited against WikiOasis. The issue would have required an attacker to already be running code on one of our servers. The decision to perform this maintenance was done out of an abundance of caution to minimise the risk if malicious code were to run on one of our servers, it could not exploit that vulnerability to takeover our host machine.
