Incident History for CloudLinux
A complete log of all past incidents, outages, and scheduled maintenance.
Filter by status
applies to the 14 loadedCritical IPv4 TCP kernel flaw affects CloudLinux OS
Identified
Affected Components
Identified
on Oct 30, 2026
Fixed kernels are now available for CloudLinux 7h, 8, 9, 10 and LTS releases, with staged rollouts and reboots required.
Identified
on Oct 30, 2026
CloudLinux has identified CVE-2026-98432, a critical IPv4 TCP use-after-free; fixes are in preparation or staged rollout across affected versions.
Critical PHP security release tracked for alt-php
Monitoring
Affected Components
Monitoring
on Oct 23, 2026
Correction: keep the ELS ALT PHP repository enabled, as it is becoming the single source for alt-php packages.
Monitoring
on Oct 23, 2026
Fixed ea-php builds matching PHP.net version numbers are now in stable repositories, aligning versions for CVE-2026-109618 and CVE-2026-109619.
Monitoring
on Oct 23, 2026
Fixed alt-php builds matching PHP.net version numbers are now in stable repositories for CloudLinux OS 8 and 9.
Monitoring
on Oct 22, 2026
Fixed native PHP packages for CVE-2026-109618 and CVE-2026-109619 are now in stable repositories for all affected versions.
... and 13 more update(s). Click to view the full timeline.
Node.js security releases for alt-nodejs packages
Update
Affected Components
Update
on Oct 23, 2026
Fixed alt-nodejs 10 and 19 builds are now in stable repositories for CloudLinux OS 7, 8, and 9.
Update
on Oct 22, 2026
Fixed alt-nodejs 16, 18, 20 and ea-nodejs22 builds are now in stable repositories; older versions such as alt-nodejs10 and 19 remain unreleased.
Update
on Oct 22, 2026
Fixed alt-nodejs 12 and 14 packages are now in stable repositories; alt-nodejs 16, 18, 20 and ea-nodejs22 builds remain in progress.
Update
on Oct 22, 2026
Fixed alt-nodejs 22, 24 and 26 packages are now available in CloudLinux OS 8 and 9 repositories; other builds remain in progress.
... and 3 more update(s). Click to view the full timeline.
LVE creation failure on CloudLinux 8 resolved
Resolved
Affected Components
Resolved
on Oct 20, 2026
The LVE creation failure after reboot on CloudLinux 8 with kmod-lve 2.1-78/2.1-79 has been resolved.
Monitoring
on Oct 13, 2026
Fixed kmod-lve 2.1-80 is in the stable repository and being monitored after deployment.
Monitoring
on Oct 10, 2026
Fixed kmod-lve 2.1-80 is rolling out to the stable channel, resolving LVE creation failures on CloudLinux 8 with cgroup v1.
Monitoring
on Oct 7, 2026
Fixed kmod-lve 2.1-80 is in beta; stable rollout requested, workaround advised until then.
EasyApache4 PHP GD libavif dependency conflict resolved
Resolved
Affected Components
Resolved
on Oct 12, 2026
Corrected ea-php and alt-php GD builds are in stable repositories, so dnf update completes without workarounds.
Zapscape KVM guest escape and local root resolved
Resolved
Affected Components
Resolved
on Sep 22, 2026
The Zapscape (CVE-2026-64561) KVM guest escape and local root incident affecting the CloudLinux Kernel has been resolved.
pam_lve cron logging issue resolved
Resolved
Affected Components
Resolved
on Sep 10, 2026
The pam_lve 0.4-5 cron logging issue affecting CloudLinux Kernel has been resolved.
CloudLinux Kernel Patched for Zapscape CVE-2026-64561
Monitoring
Affected Components
Monitoring
on Sep 8, 2026
Patched kernels for the Zapscape vulnerability are now in stable repositories, and the incident is being monitored.
Monitoring
on Sep 5, 2026
Patched kernel-lts packages and KernelCare livepatches for Zapscape are rolling out to stable channels.
Privilege Escalation via Phusion Passenger's Watchdog API Resolved
Resolved
Affected Components
Resolved
on Sep 1, 2026
The security incident involving privilege escalation via Phusion Passenger's Watchdog API has been resolved.
CloudLinux Kernel Vulnerability BadGarbage
Identified
Affected Components
Identified
on Aug 20, 2026
CloudLinux 10 is affected by a local root and container escape vulnerability. A patched kernel is available, and a KernelCare livepatch is in preparation.
Zapscape KVM guest escape and local root
Monitoring
Affected Components
Monitoring
on Aug 19, 2026
KernelCare patches are available for ePortal on rhel10, oel10, rockylinux10, and almalinux10. Subscribed servers receive updates automatically or via kcarectl --update.
Update
on Aug 18, 2026
CloudLinux has posted KernelCare patchsets for multiple distributions to address the Zapscape vulnerability, with some pending.
Update
on Aug 14, 2026
KernelCare livepatches for Zapscape are now in the main feed for CloudLinux 9 and 10, with automatic or manual update instructions.
Update
on Aug 13, 2026
CloudLinux has posted an update with KernelCare patches for the Zapscape KVM guest escape and local root vulnerability.
... and 1 more update(s). Click to view the full timeline.
CloudLinux Kernel Vulnerability BadGarbage
Identified
Affected Components
Identified
on Aug 18, 2026
CloudLinux 10 is affected by a local root and container escape vulnerability. A patched kernel is available, and a KernelCare livepatch is in preparation.
CloudLinux Kernel Security Update for Zapscape
Monitoring
Affected Components
Monitoring
on Aug 15, 2026
Patched versions for the Phusion Passenger privilege escalation are available in the stable repository and monitoring is ongoing.
Zapscape CVE-2026-64561 KVM Guest-to-Host Escape
Identified
Affected Components
Identified
on Aug 7, 2026
CloudLinux is addressing a critical KVM guest-to-host escape vulnerability affecting multiple versions, with patches available for some and mitigations provided.