VPS providers have been patching and restarting the hosts of their VPS / cloud servers following CVE-2026-99999 for the past days since the vulnerability was made public on the 15th. Some of these likely run Bitcoin nodes. It would be interesting to see the effect of this on the network.
Timeline
(all times UTC, researched with an LLM)
Before disclosure
08-18 – Vercel opens its $1M Sandbox challenge. The researcher reports a host memory leak to Vercel within days (TuxCare).
09-04 – Root cause reported privately to the kernel security contact and networking maintainers (TuxCare).
10-08 – Fix accepted into the networking tree (6785011f8b16).
10-14 – Fix merged into the main Linux tree. Vercel publishes its challenge findings.
Disclosure and provider response
10-15 12:19 – CVE published by the kernel CVE team, CVSS 9.3 (cve.org). pwn.ai write-up and fixed stable kernels the same day.
10-15 17:27 – Akamai (Linode): applying mitigations, customer workloads may be affected (status).
10-15 17:30 – AWS: EC2, Lambda and Fargate not affected, no customer action needed (2026-137-AWS).
10-15 17:33 – Contabo: patching all VPS/VDS hosts, customers should expect restarts (status).
10-16 08:53 – Akamai: patching in phases, no exploitation seen.
10-16 21:38 – netcup announces VPS/root server reboots from 10-17, block by block, about 20–30 min downtime each (status, linked in the forum).
10-17 05:07 – Akamai: all compute hypervisors patched, no exploitation seen.
10-17 ~12:03 – First netcup reboot emails reported, sent shortly before the restarts (forum).
by 10-17 – Debian lists fixed kernels for bookworm and trixie (tracker). Ubuntu was still evaluating as of 10-18 (tracker).
10-19 12:24 – netcup update: names PwnEscape as the reason and apologizes for the short notice. Reboot emails now go out about 1 h ahead.
10-19 – Hetzner tells heise it put an eBPF-based mitigation in place shortly after disclosure and does not need to restart its hypervisors right away. Nothing about the CVE on status.hetzner.com.
As of 10-19 – No public statement found from OVHcloud, DigitalOcean or Google Cloud.
Both Contabo and netcup restarted their VPS hosts after CVE-2026-99999, which shows up in the KIT DSN snapshots (peers connected to KIT’s monitors, grouped by AS, compared day to day) and in the bitnod.es explorer.
Contabo announced on 2026-10-15 at 17:33 UTC that it was patching all VPS hosts and customers should expect restarts. In the KIT data, 17% of Contabo peers (33 of 199) dropped out in the 24 h before the 2026-10-18 snapshot, against 2.5–4.7% per day before. The number of Contabo peers fell from 199 to 170. Few of the rest reconnected, so most of the missing nodes went down and stayed down. bitnod.es shows 40 Contabo nodes that were last seen on 2026-10-18 and haven’t come back, against 1–2 per day before, with 149 still up.
netcup restarted its hosts block by block from 2026-10-17, about 20–30 min each, with emails sent shortly before. In the KIT data, 14% of netcup peers dropped out in the day before the 2026-10-17 snapshot and 27% in the day before the 2026-10-18 one, against 0–1.5% per day before. 11% and 26% reconnected, against 3–6% before. The number of netcup peers fell from 66 to 50. On bitnod.es, 5 netcup nodes were last seen on 2026-10-17 and 5 on 2026-10-18, against 0–1 per day before. The 2026-10-18 KIT snapshot (12:38 UTC) is the latest I used, so netcup’s later restart blocks aren’t covered yet.
On both providers, some nodes came back after the restart and some didn’t, possibly because bitcoind isn’t set to start on boot.
KIT runs their nodes on dedicated machines and not cloud machines that might have been affected by this. @matthias, can you confirm?
Yes, I can confirm. We haven’t restarted our nodes.
Thanks for your analysis of the snapshots. That’s very interesting!
I think, however, that the churn that we see in the total amount of connections is probably unrelated to this event. We have already seen a similar amount of churn during the last months:
