PATCHING AT FLEET SCALE, TWICE: HOW DIGITALOCEAN CLOSED JANUSCAPE AND THE AMD SAFE RET ISSUE WITHOUT CUSTOMER IMPACT

Summary from the TLDR DevOps newsletter

DigitalOcean patched its entire hypervisor fleet against two separate guest-to-host vulnerabilities within a single month, reporting zero confirmed customer-facing impact in both cases. The first, a KVM nested virtualization flaw called Januscape (CVE-2026-53359), was publicly disclosed July 6 and fully remediated across all hypervisors by July 14, eight days later. The second affected roughly 1,600 AMD hypervisors across twelve regions and required a kernel update and reboot on every machine, a harder constraint than the first, yet the entire fleet was patched by August 5, one day before AMD published its public bulletin.