Fly.io Got Breached

Fly.io’s account centers on CVE-2026-99999, a Linux kernel flaw in checksum offloading for IPv4 packets sent from virtual machines. By crafting packet metadata, an attacker could make a host rewrite two bytes of an IP header after routing and firewall checks. That enabled firewall bypasses and an out-of-bounds read that could expose up to 32 bytes of adjacent memory, potentially including packets or kernel data from neighboring workloads. Fly.io says the issue was disclosed with exploit details on October 15, and that the vulnerable window lasted until its fleet was patched and rebooted. The company found no evidence that customer data was exposed, but says cross-app traffic leakage was theoretically possible. It advised customers running workloads from October 15-17 to rotate credentials sent over unencrypted protocols, including over Fly’s private network.

Because the flaw was difficult to detect and existing network filters could not catch the rewrite, Fly chose to reboot hosts into patched kernels. The ten-hour operation involved staggered regional waves to protect Managed Postgres clusters, but hardware problems left some Machines offline until October 20; Fly reports no lost Machines or customer data. Fly also explains why its initial status notice described emergency maintenance without naming the security issue: it feared confirming active vulnerability while attackers had public exploit details. The incident prompted a formal communications plan and reinforced practical defenses: encrypt internal traffic, use short-lived, narrowly scoped credentials, separate secrets from production data, treat agent-accessible content as hostile, and rehearse credential rotation.