Is Osuosl Down?

From about 8:24 AM PST (16:24 UTC), one of our shared MySQL database servers was overloaded, so websites that use it loaded slowly or showed database errors. Other sites on our shared web hosting were also slow, because their web servers were stuck waiting on this database. Affected: - phpBB websites and services, including the forums, blog and Area51 - eLinux.org - Ogre3D's website, forum and wiki - the Amahi wiki and blog - the BusyBox bug tracker - the Mycroft Project - SeaMonkey updates - OpenID Foundation sites, the OpenPOWER Foundation's Nextcloud and our Etherpad - other websites on our shared web hosting We found the source of the load and restarted the database service. Service has been restored for most sites as of 10:17 AM PST (18:17 UTC); Ogre3D's sites are still unavailable while we work with that project. Our other database servers, mail, DNS and the FTP mirrors were not affected. We are monitoring the server and will post another update.

Some clients can no longer verify the HTTPS certificate on most of our osuosl.org sites, including the ftp.osuosl.org mirrors (ftp-nyc, ftp-chi and ftp-osl). Downloads fail with "unable to get local issuer certificate" (curl error 60) or a Java "unable to find valid certification path" error. Who is affected: - Amazon Linux 2023 and Amazon Linux 2 hosts with the latest ca-certificates package (ALAS2023-2026-3306, ALAS2-2026-4037), which removed every eMudhra root. - Java runtimes whose trust store has dropped eMudhra's emSign Root CA - G1. - Anything else that has removed all eMudhra roots, such as a corporate trust policy. Not affected: Web browsers and most Linux distributions still trust this certificate, and the sites themselves are up. What happened: The *.osuosl.org certificate most of our sites use comes from InCommon and chains to eMudhra's emSign Root CA - G1. After last month's eMudhra key compromise, which involved a different eMudhra hierarchy, some vendors removed all eMudhra roots, including this one. The Jenkins project has temporarily taken our mirrors out of its download rotation for this reason. What we're doing: We are moving the ftp.osuosl.org mirrors to Let's Encrypt certificates, which we expect to finish in the next couple of weeks, and will post here when they have switched. Our other osuosl.org certificates will move off eMudhra before the current certificate expires in February. If you are affected and need help in the meantime, email support@osuosl.org.

A critical flaw in the Linux kernel's IPv4 TCP code (CVE-2026-98432, CVSS 9.8) lets a remote attacker with no login crash the kernel, and possibly run code, by sending crafted packets to any open TCP port. If your project runs Linux on an OpenStack VM or a server that you manage yourself, please install your distribution's fixed kernel as soon as it is available and reboot into it. Who needs to act: - Projects that manage their own OpenStack VMs or colocated servers running Linux. Every distribution is affected. - Hosts that OSL manages for you: we have already applied the interim mitigation below and will reboot them onto fixed kernels in our normal maintenance windows, announced here as usual. Fix status (Nov 1): - Debian: fixed. Debian 13 in 6.12.113-1 (DSA-6568-1), Debian 12 in 6.1.190-1 (DLA-4841-1). - AlmaLinux 8, 9 and 10: fixed kernels are in the testing repository (4.18.0-553.180.2, 5.14.0-687.61.2, 6.12.0-211.69.2) and not yet in the regular updates. - RHEL and Ubuntu: no fixed kernel yet; Red Hat rates the flaw Critical and Ubuntu has fixes in progress. For other distributions, including those built from RHEL, check your vendor's security notices. Interim mitigation: Until you can reboot onto a fixed kernel, drop incoming IPv4 TCP packets that carry IP options, which normal traffic does not use. Red Hat's bulletin gives this nftables rule (run as root; it lasts until the next reboot): nft add table inet cve_2026_98432 nft add chain inet cve_2026_98432 input '{ type filter hook input priority -310 ; policy accept ; }' nft add rule inet cve_2026_98432 input ip protocol tcp ip hdrlength gt 5 counter drop If the VM runs Docker or other containers, add the same chain and rule with "forward" in place of "input" so container ports are covered too. Remove it after rebooting onto the fixed kernel with: nft delete table inet cve_2026_98432 Red Hat's bulletin: https://access.redhat.com/security/vulnerabilities/RHSB-2026-016 If you are unsure whether you are affected or need help, email support@osuosl.org. --- [2026-11-02T21:47:34.036Z] (600) Update (Nov 2): AlmaLinux's fixed kernels for CVE-2026-98432 are now in the regular updates for AlmaLinux 8 (4.18.0-553.182.1), 9 (5.14.0-687.64.1) and 10 (6.12.0-211.72.1). If your VM runs AlmaLinux, run "dnf update kernel" and reboot into the new kernel; you can then remove the interim nftables rule. For other distributions, check your vendor's security notices. On our side, the OpenStack servers move onto fixed kernels on Tuesday, November 3 (live migrations, no restart) and Thursday, November 5 (VMs restarted once), in the two maintenance notices on this page. Those reboots update our servers only, so VMs still need their own kernel update. If you need help, email support@osuosl.org. --- [2026-11-04T21:02:21.305Z] (600) Update (Nov 4): Our own internet-facing servers move onto fixed kernels in two maintenance windows. On Thursday, November 12, 11:00 AM – 3:00 PM PST (19:00 – 23:00 UTC), we reboot our CI runners and OSL services. On Friday, November 13, 10:00 AM – 1:00 PM PST (18:00 – 21:00 UTC), we reboot the project sites, mailing lists and FTP mirrors we host. The firewall rule on those servers stays in place until then. Thursday: https://status.osuosl.org/pages/maintenance/526712bf10cd4e587b000014/6aeb9bd7f7bb4b038d276f4d Friday: https://status.osuosl.org/pages/maintenance/526712bf10cd4e587b000014/6aeb9bf5b435fe0422769f92 These reboots update our servers only. If your VM runs AlmaLinux, run "dnf update kernel" and reboot into the new kernel, as in our Nov 2 update. If you need help, email support@osuosl.org.

Scheduled Maintenance

Scheduled Maintenance