Back to overview
Resolved

Urgent security maintenance: CVE-2026-99999 (PwnEscape) – patch KVM hypervisors

Oct 17, 2026 at 7:00am UTC  –  Oct 17, 2026 at 9:00am UTC
Affected services
[EU] - Budget VPS | fra1-bv-023
[EU] - Budget VPS | fra1-bv-001
[EU] - Budget VPS | fra1-bv-002
[EU] - Budget VPS | fra1-bv-003
[EU] - Budget VPS | fra1-bv-004
[EU] - Budget VPS | fra1-bv-005
[EU] - Budget VPS | fra1-bv-016
[EU] - Budget VPS | fra1-bv-006
[EU] - Budget VPS | fra1-bv-007
[EU] - Budget VPS | fra1-bv-008
[EU] - Budget VPS | fra1-bv-009
[EU] - Budget VPS | fra1-bv-010
[EU] - Budget VPS | fra1-bv-011
[EU] - Budget VPS | fra1-bv-012
[EU] - Budget VPS | fra1-bv-013
[EU] - Budget VPS | fra1-bv-014
[EU] - Budget VPS | fra1-bv-015
[EU] - Budget VPS | fra1-bv-017
[EU] - Budget VPS | fra1-bv-027
[EU] - Budget VPS | fra1-bv-018
[EU] - Budget VPS | fra1-bv-019
[EU] - Budget VPS | fra1-bv-020
[EU] - Budget VPS | fra1-bv-021
[EU] - Budget VPS | fra1-bv-022
[EU] - Budget VPS | fra1-bv-025
[EU] - Budget VPS | fra1-bv-026
[EU] - Budget VPS | fra1-bv-028
[EU] - Budget VPS | fra1-bv-029
[EU] - Budget VPS | fra1-bv-030
[EU] - Budget VPS | fra1-bv-031
[EU] - Budget VPS | fra1-bv-032
[EU] - Budget VPS | fra1-bv-033
[EU] - Budget VPS | fra1-bv-034
[EU] - Budget VPS | fra1-bv-035
[US] - Budget VPS | lax1-bv-001
[US] - Budget VPS | lax1-bv-002
[EU] - Budget VPS | fra1-bv-036
[US] - Budget VPS | lax1-bv-003
[US] - Budget VPS | lax1-bv-004
[EU] - Budget VPS | fra1-bv-037
[EU] - Budget VPS | fra1-bv-038
[EU] - Budget VPS | fra1-bv-039
[US] - Budget VPS | lax1-bv-005
[EU] - Budget VPS | fra1-bv-040
[EU] - Budget VPS | fra1-bv-041
[EU] - Budget VPS | fra1-bv-024
[EU] - Budget VPS | fra1-bv-042
[EU] - Budget VPS | fra1-bv-043
[EU] - Budget VPS | fra1-bv-044
[EU] - Budget VPS | fra1-bv-045
[EU] - Budget VPS | fra1-bv-046
[EU] - Premium VPS | fra1-pv-007
[EU] - Premium VPS | fra1-pv-002
[EU] - Premium VPS | fra1-pv-003
[EU] - Premium VPS | fra1-pv-004
[US] - Premium VPS | dal1-pv-001
[US] - Premium VPS | dal1-pv-002
[US] - Premium VPS | dal1-pv-003
[EU] - Premium VPS | fra1-pv-005
[EU] - Premium VPS | lon1-pv-001
[EU] - Premium VPS | lon1-pv-002
[US] - Premium VPS | dal1-pv-004
[EU] - Premium VPS | fra1-pv-006
[EU] - Premium VPS | fra1-pv-001
[US] - Premium VPS | dal1-pv-005
[EU] - Premium VPS | wys1-pv-001
[US] - Premium VPS | dal1-pv-006
[EU] - Premium VPS | fra1-pv-008
[US] - Premium VPS | ash1-pv-001
[EU] - Premium VPS | fra1-pv-009
[EU] - Premium VPS | fra1-pv-010
[US] - Premium VPS | ash1-pv-002
[US] - Premium VPS | lax1-pv-001
[EU] - Premium VPS | wys1-pv-002
[US] - Premium VPS | mia1-pv-001
[US] - Premium VPS | ash1-pv-003
[EU] - Premium VPS | wys1-pv-003
[US] - Premium VPS | lax1-pv-002
[US] - Premium VPS | mia1-pv-002
[EU] - Premium VPS | wys1-pv-004
[EU] - Premium VPS | wys1-pv-005
[EU] - Premium VPS | fra1-pv-012
[EU] - Premium VPS | fra1-pv-011
[US] - Premium VPS | ash1-pv-004
[EU] - Premium VPS | wys1-pv-007
[EU] - Premium VPS | wys1-pv-006
[EU] - Premium VPS | wys1-pv-008
[EU] - Premium VPS | wys1-pv-009
[EU] - Premium VPS | lon1-pv-003
[EU] - Premium VPS | fra1-pv-013
[US] - Premium VPS | lax1-pv-003
[EU] - Extreme VPS | bac1-ev-001
[EU] - Extreme VPS | bac1-ev-002
[EU] - Extreme VPS | fra1-ev-001
[EU] - Extreme VPS | fra1-ev-002
[EU] - Extreme VPS | fra1-ev-003
[EU] - Extreme VPS | fra1-ev-004
[EU] - Extreme VPS | wys1-ev-001

Resolved
Oct 17, 2026 at 9:00am UTC

Maintenance completed.

The security update for CVE-2026-99999 has been applied to 98 of our 99 VPS hypervisors. Each was restarted on the patched kernel and checked, and the VPS on them are back online.

The one remaining hypervisor, lax1-bv-001 (Los Angeles), is being handled in a separate incident so it can be tracked on its own: see "Investigating: lax1-bv-001 (Los Angeles) VPS hypervisor offline" on this page.

If your VPS is not on lax1-bv-001 and you still have a problem, open a ticket in the client area and we will check it straight away.

Thank you for your patience. This was a required security fix, and we are grateful for your understanding.

The FREAKHOSTING team

Updated
Oct 17, 2026 at 9:13am UTC

Update: The maintenance is complete, except for two hypervisors that our team is checking manually.

The security update for CVE-2026-99999 has been applied to 97 of our 99 VPS hypervisors. Each one was restarted on the patched kernel and checked. The VPS on them are back online.

Still being checked by our team: two hypervisors need hands-on attention: fra1-bv-025 and lax1-bv-001. If your VPS runs on one of them, it may still be offline. We are working on both now. You do not need to do anything. If you would like a status on your own VPS, open a ticket in the client area and we will reply straight away.

Server management: the VPS control panel is available again for all hypervisors that have been completed.

If your VPS is not on fra1-bv-025 or lax1-bv-001 and it is still unreachable, open a ticket in the client area and we will check it straight away.

We will post here as soon as the last two hypervisors are back online. Thank you for your patience.

Updated
Oct 17, 2026 at 9:00am UTC

Maintenance ended

Updated
Oct 17, 2026 at 8:37am UTC

Update: Wave 2 is complete. Wave 3, the final wave, is now in progress.

Wave 2 (Frankfurt premium and extreme): 17 hypervisors have been restarted on the patched kernel and checked. They are back online.

  • Frankfurt premium: fra1-pv-001, fra1-pv-002, fra1-pv-003, fra1-pv-004, fra1-pv-005, fra1-pv-006, fra1-pv-007, fra1-pv-008, fra1-pv-009, fra1-pv-010, fra1-pv-011, fra1-pv-012, fra1-pv-013
  • Frankfurt extreme: fra1-ev-001, fra1-ev-002, fra1-ev-003, fra1-ev-004

Hypervisors finished by our team: fra1-bv-014, lax1-bv-002 and lax1-bv-003 were slower to come back after their restart. They are now back online and checked. lax1-bv-001 is still being worked on by our team. If your VPS runs on lax1-bv-001, it may still be offline. You do not need to do anything.

Wave 3 (now restarting): 49 hypervisors are restarting at this moment.

  • Frankfurt budget: fra1-bv-001 to fra1-bv-046, except fra1-bv-013 and fra1-bv-014, which were completed earlier
  • Dallas: dal1-pv-002, dal1-pv-003, dal1-pv-004, dal1-pv-005, dal1-pv-006

If your VPS runs on one of these, it is offline for the restart. Budget and Dallas servers can take longer than the 10 to 20 minutes we first estimated, so please allow up to 30 minutes. Your VPS starts again automatically.

Timing: this wave will finish after 10:00 UK time. We will post here when it is complete. Any server that has not come back by then will be handled by our team directly, and we will say so on this page.

Need help? If your VPS is still unreachable 30 minutes after its host restarted, open a ticket in the client area and we will check it straight away.

Thank you for your patience.

Updated
Oct 17, 2026 at 8:03am UTC

Update: Wave 1 is complete. Wave 2 is starting.

Wave 1: 28 hypervisors have been restarted on the patched kernel and checked. They are back online.

  • Ashburn (ash1): ash1-pv-001, ash1-pv-002, ash1-pv-003, ash1-pv-004, ash1-pv-005
  • bac1: bac1-ev-001, bac1-ev-002
  • Frankfurt (fra1): fra1-bv-013
  • Los Angeles (lax1): lax1-bv-004, lax1-bv-005, lax1-pv-001, lax1-pv-002, lax1-pv-003
  • London (lon1): lon1-pv-001, lon1-pv-002, lon1-pv-003
  • Miami (mia1): mia1-pv-001, mia1-pv-002
  • wys1: wys1-ev-001, wys1-pv-001, wys1-pv-002, wys1-pv-003, wys1-pv-004, wys1-pv-005, wys1-pv-006, wys1-pv-007, wys1-pv-008, wys1-pv-009

Being finished by our team: four hypervisors were slower to come back and need manual attention: fra1-bv-014, lax1-bv-001, lax1-bv-002 and lax1-bv-003. If your VPS runs on one of them, it may take longer than the 10 to 20 minutes we expected. You do not need to do anything. If it is still unreachable after we post that these are complete, open a ticket in the client area.

Next: Wave 2 (Frankfurt) is starting now. The remaining Dallas hypervisors will be restarted in a separate step. Anything we have not reached by 10:00 UK time will be handled in a short follow-up window, which we will announce on this page.

Thank you for your patience.

Updated
Oct 17, 2026 at 7:00am UTC

Urgent security maintenance: required for all VPS host servers

We are restarting all VPS host servers to fix CVE-2026-99999 ("PwnEscape"), a critical Linux kernel vulnerability. This maintenance is required and cannot be postponed.

  • When: Saturday 17 October 2026, 08:00–10:00 (UK time)
  • Who is affected: VPS customers, all locations
  • Expected downtime: about 10 to 20 minutes per VPS (one restart)
  • Your data: not affected

Why this is urgent

CVE-2026-99999 (PwnEscape) is a critical flaw (CVSS 9.3 out of 10) in the Linux kernel's networking code.

  • On servers that run virtual machines, a malicious or compromised virtual machine could read memory from the physical host underneath it, and potentially take control of that host.
  • That could put every other VPS on the same server at risk.
  • Technical details were published this week, so attacks are expected soon.
  • Debian has only just released the fix, and it only takes effect after the host restarts. This maintenance cannot be skipped.

What will happen

  • We restart host servers in waves, across all locations.
  • Each VPS is stopped and started once, and starts again automatically when its host is back.
  • We can't say in advance which minute your VPS will restart within the window. We will post an update on this page as each wave completes.
  • A small number of hosts need separate handling and will be scheduled separately.
  • If any VPS has not been restarted by 10:00, we will announce a short follow-up window on this page.

What you need to do

Nothing is required. We recommend that you:

  • Make sure your services start automatically after a reboot.
  • Back up any data you can't afford to lose.
  • Avoid starting critical work during the window.

If your VPS is still unreachable 30 minutes after its restart, open a ticket in the client area (VPS department) and we will check it straight away.

More information

Thank you for your patience. This is a required security fix, and we are doing it as quickly and safely as we can.

The FREAKHOSTING team

Created
Oct 17, 2026 at 6:59am UTC

Maintenance is now in progress.

We have started the security update (CVE-2026-99999) on our VPS host servers. We are working in waves: first a single test host, then the remaining hosts across all locations.

  • What to expect: each VPS restarts once. Expected downtime is about 10 to 20 minutes per VPS. Your VPS starts again automatically once its host is back.
  • Timing: we expect to finish by 10:00 UK time. We will post an update here as each wave completes. Any VPS not reached by then will be handled in a short follow-up window, which we will announce on this page.
  • Need help? If your VPS is still unreachable 30 minutes after its restart, open a ticket in the client area and we will check it straight away.

Thank you for your patience.