November 2026 Summaries

Fly.io reported that it patched and rebooted its entire host fleet over roughly 10 hours after disclosure of Linux kernel vulnerability CVE-2026-99999, which affected IPv4 checksum-offload validation in virtualized networking. The flaw could allow a malicious virtual machine to alter two bytes in an IPv4 header after the host had made routing and firewall decisions, enabling potential firewall bypasses or limited out-of-bounds memory reads that might expose small portions of neighboring workloads’ traffic or host memory. Fly.io said it found no evidence of customer data exposure, but advised customers operating between October 15 and 17 to rotate credentials transmitted through unencrypted channels, including HTTP and unencrypted 6PN traffic. The company coordinated rolling reboots in regional waves to preserve Managed Postgres availability where possible, though some hosts suffered hardware or reboot problems and remained unavailable until October 20; it stated that no Fly Machines or customer data were lost. Fly.io also acknowledged criticism of its initially limited maintenance notice, explaining that it withheld technical details while systems were still vulnerable, and said it has revised its incident communications process while urging customers to encrypt internal traffic, limit and expire credentials, isolate sensitive systems, treat external inputs cautiously, and practice credential rotation.

Daniel Botha explains how to run OpenClaw, an open-source AI assistant for messaging platforms such as WhatsApp, Telegram, Slack, Discord, and Signal, inside a Sprite rather than on a dedicated Mac Mini. Sprites are hardware-isolated Linux environments with persistent storage and automatic sleep-and-wake behavior, enabling users to grant the assistant broad permissions while containing it in a sandbox and reducing idle costs. The setup involves installing the Sprites CLI, creating and accessing a Sprite, running OpenClaw’s installation wizard, saving its generated access token, and adding its executable path to the shell configuration. Because Sprites do not use systemd, OpenClaw’s Gateway is registered through the Sprite service manager, which starts it automatically when requests reach its assigned URL. Users may optionally make the URL public, access the dashboard with the onboarding token, approve the browser as a paired device through the command line, and create a checkpoint to preserve the configured state. Once deployed, the Gateway retains its configuration and device pairing across restarts, and the post suggests optionally having OpenClaw create a custom Sprite skill to manage services, checkpoints, restarts, and network policies.