Dear all,

We would like to inform you about an upcoming scheduled maintenance window on the EUMETSAT side of the European Weather Cloud. The maintenance will take place from 22 June 2026, 06:00 UTC to 26 June 2026, 14:00 UTC.

This intervention is required to perform a major upgrade of the underlying Ceph storage system. No service interruption is expected, and all existing virtual machines and services should continue to operate normally throughout the maintenance.

While we do not anticipate user‑visible impact, there may be occasional periods of reduced performance or slower operations due to temporary load on the storage nodes during the upgrade. We recommend keeping an eye on workflows that are particularly sensitive to I/O performance.

We appreciate your understanding and cooperation. Our team and the cloud provider will be closely monitoring the environment during the entire maintenance window.

For updates during the maintenance, please refer to the Service status | The European Weather Cloud.

Best regards,

EWC Team at EUMETSAT

Dear all,

EUMETSAT EWC R&D Projects should be scientific or technical studies to improve the use of EUMETSAT data or products. They have to provide benefits to EUMETSAT Member States through the broad applicability of the project results, and to be of interest to the general scientific community.

EWC R&D Projects provide access to the operational European Weather Cloud service. Public institutions from Member and Cooperating States may apply via the EWC R&D application form: https://ec.europa.eu/eusurvey/runner/EUMETSAT_EWCCall.

For further information on this opportunity and all details on the application process, please check the https://user.eumetsat.int/news-events/news/european-weather-cloud-research-and-development-call.

If you miss the 30 June deadline, you could still submit a "fast-track" via the same form as soon as you can, but the total amount of accessible resources will be limited in size.

For more information on this call and EUMETSAT data, contact our User Service Helpdesk https://www.eumetsat.int/contact-us.

ECMWF Special Projects have been renamed to European Meteorological Infrastructure Research and Development Projects (EMI R&D Projects).

From 2024 EMI R&D Projects, beside the HPC resources, also have the access to the operational European Weather Cloud service. 

EMI R&D Projects are defined as 'experiments or investigations of a scientific or technical nature, likely to be of interest to the general scientific community'.

Users within one of ECMWF's Member or Co-operating States may apply for resources as a  EMI R&D Project. This possibility is particularly, but not exclusively, suitable for projects which are undertaken in co-operation between several institutions, nationally or internationally.

If you are interested in this service, please indicate your resource requirements and add a section outlining your intended usage to your EMI R&D Projects request.

For further information on this opportunity and to submit the applications, see: The EMI R&D Projects application page.

If you miss the 30 June deadline, you could still submit a "late request" via the dedicated form as soon as you can, but the total amount of accessible resources might be limited in size.

If you have any questions before submitting the application, please email special_projects@ecmwf.int.

A new Linux kernel vulnerability known as SSH-keysign-pwn (tracked as CVE-2026-46333) was publicly disclosed on 14 May 2026. 

This vulnerability allows an unprivileged local user to read any files owned by root. A working exploit is already publicly available.

Risk Level: When This Vulnerability Is Dangerous

This vulnerability can only be exploited by someone who is able to run local commands on your virtual machine. This means the real‑world risk depends on how your system is exposed and who can access it.

High‑Risk Scenarios (Immediate Action Required)

Your system is at high risk if any of the following are true:

• The VM is externally accessible (SSH open to the internet, public endpoints, jump hosts, etc.).
• You have local users who are not already trusted with root privileges.

In these cases, an attacker who gains any local foothold can escalate to root instantly.

Low‑Risk Scenarios (Not Urgent, but Still Recommended)

The urgency is lower if:

• Your VM is not externally exposed,
• All users already have root access

In these situations, the vulnerability is still present, but the practical risk of exploitation is minimal because no untrusted user can execute local commands.

Interim fix

This is valid for all EWC supported OSes: Rocky 8, Rocky9, Ubuntu22.04, Ubuntu24.04

sudo sysctl -w kernel.yama.ptrace_scope=2

Running the command above effectively breaks unprivileged process tracing with tools such as gdb -p or strace. Those would still work as root. To disable process debug attachment completely, including for root),  you may increase the scope with:

sudo sysctl -w kernel.yama.ptrace_scope=3

A new Linux kernel vulnerability known as Dirty Frag was publicly disclosed on 7 May 2026. The flaw affects the IPsec ESP and rxrpc in-place decryption fast paths and is closely related to the same subsystem area impacted by the recent Copy Fail vulnerability.

Dirty Frag allows an unprivileged local user to gain immediate root access on all major Linux distributions. A working exploit is already publicly available.

The Dirty Frag exploit works by corrupting page-cache pages of sensitive files (such as /etc/passwd or /usr/bin/su).  (reference: AlmaLinux OS - Forever-Free Enterprise-Grade Operating System)

esp4 / esp6 are the kernel-side ESP transforms used by IPsec. Disabling them breaks IPsec tunnels that rely on the kernel data path on the affected machine. Do not apply this mitigation on hosts that terminate or transit IPsec / strongSwan / Libreswan tunnels. rxrpc is the AF_RXRPC transport used almost exclusively by AFS clients and is not present on typical web-hosting servers. (reference: Dirty Frag [CVE Pending]: Mitigation and Kernel Update on CloudLinux)

What is its relationship with the "Copy Fail" vulnerability?

Copy Fail was the motivation for starting researching new vulnerabilities. In particular, xfrm-ESP Page-Cache Write in the Dirty Frag vulnerability chain shares the same sink as Copy Fail. However, it is triggered regardless of whether the algif_aead module is available. In other words, even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) is applied, your Linux is still vulnerable to Dirty Frag. (reference V4bel/dirtyfrag)

Risk Level: When This Vulnerability Is Dangerous

This vulnerability can only be exploited by someone who is able to run local commands on your virtual machine. This means the real‑world risk depends on how your system is exposed and who can access it.

High‑Risk Scenarios (Immediate Action Required)

Your system is at high risk if any of the following are true:

• The VM is externally accessible (SSH open to the internet, public endpoints, jump hosts, etc.).
• You have local users who are not already trusted with root privileges.

In these cases, an attacker who gains any local foothold can escalate to root instantly.

Low‑Risk Scenarios (Not Urgent, but Still Recommended)

The urgency is lower if:

• Your VM is not externally exposed,
• All users already have root access

In these situations, the vulnerability is still present, but the practical risk of exploitation is minimal because no untrusted user can execute local commands.

Interim fix

This is valid for all EWC supported OSes: Rocky 8, Rocky9, Ubuntu22.04, Ubuntu24.04

No output is expected.

EUMETSAT Managed Kubernetes

CLI - kubectl

pre-requisite: have a machine with kubectl installed and your kubeconfig in ~/.kube/ folder

Update each MachineDeployment that should use the custom profile:

kubectl --context <user-cluster-context> annotate machinedeployment -n kube-system <machine-deployment-name> \ k8c.io/operating-system-profile=osp-ubuntu-ewc-1105202601 \ --overwrite

Changing the OSP annotation does not automatically rotate existing machines. Trigger a rolling restart so the MachineDeployment creates new machines with the new profile:

forceRestartAnnotations="{\"spec\":{\"template\":{\"metadata\":{\"annotations\":{\"forceRestart\":\"$(date +%s)\"}}}}}" 
kubectl --context <user-cluster-context> patch machinedeployment -n kube-system <machine-deployment-name> \ --type=merge \ -p "$forceRestartAnnotations"

Watch the rollout:

kubectl --context <user-cluster-context> get machinedeployments,machines -n kube-system -o wide kubectl --context <user-cluster-context> get nodes -o wide

KKP UI

On the KKP UI, the process would be similar via ClickOps, and would need to be done for each intended node pool of each user cluster.

Once logged in go to Resources - > Clusters → Select your cluster. In the Machine Deployment section click the edit button.

In the new window open, scroll down until you find the Operating System Profile and change to the new value: osp-ubuntu-custom-1105202601. And then hit Save Changes.

After that, in the same Machine Deployment section, you can use the Refresh button to refresh the node pool.

Copy Fail — CVE-2026-31431 is a critical Linux kernel vulnerability that allows any unprivileged local user to escalate privileges to root. The issue originates from a flaw in the algif_aead cryptographic subsystem, which enables a controlled write into the page cache of readable files. This makes it possible to modify in‑memory SUID binaries and gain full system control.

All major Linux distributions released from 2017 are affected unless patched. 

Kernel patches are not available yet for the different Operating System flavours supported on the EWC, but there are interim mitigations that must be applied while waiting for the proper fix.

Risk Level: When This Vulnerability Is Dangerous

Copy Fail (CVE‑2026‑31431) can only be exploited by someone who is able to run local commands on your virtual machine. This means the real‑world risk depends on how your system is exposed and who can access it.

High‑Risk Scenarios (Immediate Action Required)

Your system is at high risk if any of the following are true:

• The VM is externally accessible (SSH open to the internet, public endpoints, jump hosts, etc.).
• You have local users who are not already trusted with root privileges.

In these cases, an attacker who gains any local foothold can escalate to root instantly.

Low‑Risk Scenarios (Not Urgent, but Still Recommended)

The urgency is lower if:

• Your VM is not externally exposed,
• All users already have root access

In these situations, the vulnerability is still present, but the practical risk of exploitation is minimal because no untrusted user can execute local commands.

Interim fix for Rocky 8

grep -q 'initcall_blacklist=algif_aead_init' /etc/default/grub || sudo sed -i -E 's/^(GRUB_CMDLINE_LINUX_DEFAULT=")([^"]*)"/\1\2 initcall_blacklist=algif_aead_init"/' /etc/default/grub; sudo grub2-mkconfig -o /boot/grub2/grub.cfg; sudo reboot

Interim fix for Rocky 9

sudo grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"; sudo reboot

Interim fix for Ubuntu 22.04

sudo su
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf && rmmod algif_aead

Interim fix for Ubuntu 24.04

sudo su
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf && rmmod algif_aead

Interim fix for k8s clusters that use EWC images

Setup

• Install krew

• install kubecl-node-shell

• export KUBECONFIG=path/to/file

One-line command to patch all ubuntu nodes

kubectl get nodes -o name|xargs -I "{}"  kubectl node-shell '{}' -n kube-system -- bash -c 'echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf && rmmod algif_aead'

Note: message rmmod: ERROR: Module algif_aead is not currently loaded might pop-up. but the solution worked nevertheless.

Dear all,

In preparation for the upcoming migration to EWC Identity and Access Management (IAM) system we will soon start to onboard users who have only a local account in Morpheus. These users will receive an email inviting them to reset their password for EWC IAM login.

We have introduced a new documentation page EWC Services Login that provides an overview of the types of login available at the moment (EWC IAM vs local accounts) for each service.

This update is an important step toward a unified and seamless access experience across the European Weather Cloud.

If you have any questions or encounter issues, please contact the EWC support team using https://support.europeanweather.cloud.

We would like to use this opportunity to remind about the upcoming webinar: EWC IAM and Intro to OpenStack Horizon (April 29, 2026). If you wish to register, please use this link.

EWC team

We are currently experiencing issues with a few EUMETCast Terrestrial Clients in the EWC at EUMETSAT side. We are investigating the problem.

We will contact the affected users directly and provide an update here as soon as we have more information, or by 15:00 UTC today at the latest.

If you have any questions, please do not hesitate to contact us at https://support.europeanweather.cloud.

We apologize for the inconvenience.

We are replacing the data bucket s3://seviri.meteosat-0-degree.level-15.native with the reprocessed FCDR dataset s3://seviri-meteosat-0-degree.fcdr.level15.netcdf.

The new bucket is available as of now and will be retained depending on usage and available storage capacity. The old bucket will be removed in two weeks.

For more information, please consult Using EUMETSAT data buckets (local data pool). Should you have any questions or concerns, please do not hesitate to contact us via https://chat.europeanweather.cloudor https://support.europeanweather.cloud.

Dear all,  

We are pleased to announce that a new use case has been published on the EWC website:  

• CAMS National Collaboration Programmes (NCP) Italy Initiative

We will share more updates in the future. In the meantime, we would like to remind you that you can still contribute to the EWC website by submitting your use cases.  

If you would like your use case to be featured, please contact us via our Support Portal or the EWC Discussion Platform.

Dear all,  

We are pleased to announce that a new use case has been published on the EWC website:  

• Machine Learning Emulation to accelerate Climate Science

We will share more updates in the future. In the meantime, we would like to remind you that you can still contribute to the EWC website by submitting your use cases.  

If you would like your use case to be featured, please contact us via our Support Portal or the EWC Discussion Platform.

Dear all,  

We are pleased to announce that a new use case has been published on the EWC website:  

• E-Profile - Operational data processing for ground-based remote sensing of the atmosphere on the EWC

We will share more updates in the future. In the meantime, we would like to remind you that you can still contribute to the EWC website by submitting your use cases.  

If you would like your use case to be featured, please contact us via our Support Portal or the EWC Discussion Platform.