Hetzner: CVE-2026-99999 (PwnEscape)
CVEs mentioned
- CVE-2026-99999ipv4: validate checksum_start before completing checksumCVSS 9.3 criticalnames this CVE
Only CVEs the vendor’s text names by id, or that its notice says it is not affected by. A mention is not a statement that the vulnerability caused this incident.
Timeline of updates
- investigating
Start: 2026-10-16T06:00:00+00:00
On Thursday, October 15, 2026, a security vulnerability in the Linux kernel was disclosed. Shortly after this disclosure, a temporary mitigation was developed; it detects the attack vector at the system level and, based on current knowledge, effectively neutralizes it. Further measures will be implemented over the coming hours and days.
Changes Rewindex caught on this incident
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
How the archive is checked, and what it cannot prove.
First version captured
In the 2026-10-22 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
1795467a382d6367…Version 2 captured
In the 2026-10-22 checkpoint, timestamped by FreeTSA and DigiCert on . Record hash
bc06fb500996f2b3…
Impact, status and times are the vendor’s own, as last archived. View on status.hetzner.com (opens in new tab).