Security Update: Critical Kubernetes Maintenance (CVE-2026-98432)

The Liferay Cloud Infrastructure team is performing emergency maintenance across our Kubernetes clusters. This action is being taken to patch a critical vulnerability identified as CVE-2026-98432. Reason for Emergency Action: Due to the high criticality of this vulnerability and confirmation of its exploitability by Google-GCP, InfoSec has mandated an immediate rollout today, bypassing our standard two-week notice. This rapid response is necessary to mitigate the risk of exploitation and secure all environments as quickly as possible. Technical Details & Risk: The vulnerability (CVE-2026-98432) on GKE can lead to a kernel panic or a container escape, resulting in privilege escalation and Remote Code Execution (RCE). It can be exploited locally by unprivileged processes with no requirements for capabilities, and potentially remotely via vulnerability chaining. Actions Taken: - All affected GKE clusters are being updated to apply the necessary security patch. - No action is required on your end. Liferay will execute and manage the entire maintenance procedure. Security Commitment: Protecting our customers’ data and infrastructure is our top priority. We thank you for your understanding regarding the lack of prior notice and any disruptions caused by this exceptional and necessary circumstance.