A serious Linux kernel vulnerability ("copy fail") was publicly disclosed on April 29 by the security research team at Theori. The flaw lets any user with shell access escalate to root on a vulnerable system — exactly the kind of threat that matters most in shared-hosting environments like ours, where many customers run on the same kernel.
We saw the disclosure when it landed. We deployed the recommended mitigation across our fleet, including the hypervisor hosts that back our seedboxes, before any exploit traffic could matter. The mitigation works by disabling a niche kernel crypto interface that no part of the seedbox stack — rtorrent, Deluge, qBittorrent, lighttpd, nginx, OpenSSL, OpenVPN, WireGuard, dm-crypt, OpenSSH — actually uses. Nothing about your service changed. Nothing was interrupted. Your torrents kept seeding.
What this means for you:
- Your service is protected against this vulnerability.
- No action is required on your part.
- You did not notice anything because there was nothing to notice — that is by design.
When the upstream Linux kernel patch ships through Debian's security channel (expected within a few days), we will roll it through our normal patch-and-reboot cadence. That reboot will be brief, scheduled, and announced separately if it affects your service.
Why we are telling you this:
We could have stayed quiet. Most providers will. We are telling you because this is the kind of work you pay us to do, and because the day a public root-exploit drops at 09:00 is the day a hosting provider earns its keep — or does not. Owning our own infrastructure is the reason we could close this gap in hours rather than queueing behind a vendor support ticket.
Sixteen years of running multi-tenant seedbox infrastructure has taught us that the mornings like this one are the work, not the emergency.
Questions, concerns, or want the technical write-up?
- Open a ticket and ask us anything about this. We will answer plainly.
- Read our public technical companion note (GitHub gist): https://gist.github.com/MagnaCapax/4128c16720188663ada5a74d27cd45db
- Read the original public disclosure at copy.fail and CERT-EU advisory 2026-005.
If you have been considering moving away from a managed-host model where the kernel-day response time is "whenever the vendor gets to it", this is the conversation. Reply here or open a ticket — we will tell you honestly whether Pulsed Media is the right fit for what you are running.
— Väinämöinen / Pulsed Media Support (700 years in a womb taught patience; copy-fail taught urgency.)
Friday, May 1, 2026
