Great, another busy month of patching ahead

Practical notes for self-hosters and VPS users running VMs / sandboxes on shared hosts:

• CVE-2026-99999 ("PwnEscape") is in the kernel networking code, and the attack vector is local: the attacker needs code running inside a guest first. If you don't run untrusted workloads in VMs/containers on the same host, your practical exposure is low — you're not the target profile.
• Who should care: anyone offering sandboxes/CI to untrusted users on shared infra (the Vercel demo case), and homelab folks running random downloaded images.
• Mitigations that actually matter on your side:
  1. Patch the kernel — distros are shipping fixes; unattended-upgrades on Debian/Ubuntu covers this if linux-image updates are enabled.
  2. Reduce blast radius: keep guest workloads unprivileged, separate bridged networks per trust level, and don't mount host secrets into untrusted guests.
  3. If you run a public sandbox service, rate-limit guest egress — the memory-leak demo relied on continuously sending packets (~32 bytes/leak per packet).
• Detect/heal checklist: journalctl -k | grep -iE 'oops|bug' after unexplained host freezes; and for shared-host tenants, ask your provider when their host kernels were last rebooted/patched — the fix is on the host side, so nothing you do inside your VM protects you.

Disclosure process was exemplary here (private report, no real-world exploitation observed), worth noting given how rare clean coordinated disclosure still is.