News

On July 4, 2026, following the expiration of the standard embargo period, vulnerability CVE-2026-53359 was publicly disclosed. This vulnerability has a widespread impact, affecting virtually all global VPS and cloud providers.

The published CVE describes a bug that allows a user with root or administrator privileges within a VPS to escape to the underlying host machine. This means that a VPS customer—either intentionally or unintentionally (for instance, as a result of compromised root access)—could gain access to the host, with all the associated security risks.

Proof-of-Concept Published

On Monday, July 6, 2026, at 18:00 (6:00 PM), the security researcher who originally reported the vulnerability published a proof-of-concept. This demonstration shows how a VPS can escape and cause the host machine to crash. An animated image (GIF) of this demonstration is available via the corresponding GitHub project: https://github.com/V4bel/Januscape

Patch Background

The underlying bug was already patched by Linux kernel developers on June 16, 2026. However, due to the extensive testing procedures of various Linux distributions, this patch was only widely rolled out in most cases over the past few days. Our distribution vendor made the patch available on July 7, 2026, at 16:46 (4:46 PM).

Our Response

Following a brief internal testing phase, we initiated the updates for our VM clusters in Amsterdam, Doetinchem, and Twente on July 7, 2026, at 17:45 (5:45 PM). This emergency maintenance was successfully completed at 23:00 (11:00 PM) that same evening.

Thanks to our ability to live-migrate VMs within the cluster, we were able to apply this update without any noticeable downtime. For most VMs, the impact was limited to just 100 to 200 milliseconds, spread across a migration process of approximately one minute.

Sources and References

    CVE-2026-53359 Detail Page (NVD): https://nvd.nist.gov/vuln/detail/CVE-2026-53359

    Original Report and Proof-of-Concept (Openwall oss-security mailing list): https://www.openwall.com/lists/oss-security/2026/07/06/7

    Proof-of-Concept Demonstration (GitHub, including GIF): https://github.com/V4bel/Januscape

Do you have any questions regarding this maintenance or its impact on your services? Please feel free to contact our support department.

Follow our news feed in your favorite RSS reader. RSS has the major advantage that you will never miss a news post, as your reader will notify you whenever a new post is published.
Click the RSS icon below to import our feed.

As an extension of our information services, we also make use of social media. Follow us today on X or Facebook to stay informed even more quickly about news, announcements, and other updates.