From predisclosure-applications-bounces@lists.xenproject.org Wed Sep 23 08:33:54 2026
Return-path: <predisclosure-applications-bounces@lists.xenproject.org>
Envelope-to: archives@lists.xenproject.org
Delivery-date: Wed, 23 Sep 2026 08:33:54 +0000
Received: from list by lists.xenproject.org with outflank-mailman.1428746.1652488 (Exim 4.92)
	(envelope-from <predisclosure-applications-bounces@lists.xenproject.org>)
	id 1x9IQK-0004rg-Is; Wed, 23 Sep 2026 08:33:52 +0000
X-Outflank-Mailman: Message body and most headers restored to incoming version
Received: by outflank-mailman (output) from mailman id 1428746.1652488; Wed, 23 Sep 2026 08:33:52 +0000
Received: from localhost ([127.0.0.1] helo=lists.xenproject.org)
	by lists.xenproject.org with esmtp (Exim 4.92)
	(envelope-from <predisclosure-applications-bounces@lists.xenproject.org>)
	id 1x9IQK-0004rc-Fr; Wed, 23 Sep 2026 08:33:52 +0000
Received: by outflank-mailman (input) for mailman id 1428746;
 Tue, 22 Sep 2026 12:21:34 +0000
Received: from mx.expurgate.net ([195.190.135.20])
 by lists.xenproject.org with esmtp (Exim 4.92)
 (envelope-from <alex.brett@citrix.com>) id 1x8zV7-0001uC-NH
 for predisclosure-applications@lists.xenproject.org;
 Tue, 22 Sep 2026 12:21:33 +0000
Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp
 id 1x8zV6-002r0j-Oa
 for predisclosure-applications@lists.xenproject.org;
 Tue, 22 Sep 2026 14:21:32 +0200
Received: from [10.42.69.10] (helo=localhost)
 by localhost with ESMTP (eXpurgate MTA 0.9.1)
 (envelope-from <alex.brett@citrix.com>)
 id 6ab272c4-8faa-0a2a0a5109dd-0a2a450ab148-12
 for <predisclosure-applications@lists.xenproject.org>;
 Tue, 22 Sep 2026 14:21:32 +0200
Received: from [40.107.209.47]
 (helo=PH8PR06CU001.outbound.protection.outlook.com)
 by tlsNG-4011c0.mxtls.expurgate.net with ESMTPS (eXpurgate 4.57.1)
 (envelope-from <alex.brett@citrix.com>)
 id 6ab272ca-f2d2-0a2a450a0019-286bd12f802e-3
 for <predisclosure-applications@lists.xenproject.org>;
 Tue, 22 Sep 2026 14:21:32 +0200
Received: from CH7PR03MB7859.namprd03.prod.outlook.com (2603:10b6:610:24f::20)
 by CH2PR03MB5239.namprd03.prod.outlook.com (2603:10b6:610:a2::21)
 with Microsoft SMTP Server (version=TLS1_2,
 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.14; Tue, 22 Sep
 2026 12:21:28 +0000
Received: from CH7PR03MB7859.namprd03.prod.outlook.com
 ([fe80::967:59c2:d16:1fcf]) by CH7PR03MB7859.namprd03.prod.outlook.com
 ([fe80::967:59c2:d16:1fcf%6]) with mapi id 15.21.0451.014; Tue, 22 Sep 2026
 12:21:28 +0000
X-BeenThere: predisclosure-applications@lists.xenproject.org
List-Id: Applications for membership of Xen Security Advisories Pre-disclosure
 List <predisclosure-applications.lists.xenproject.org>
List-Unsubscribe: <https://lists.xenproject.org/mailman/options/predisclosure-applications>, 
 <mailto:predisclosure-applications-request@lists.xenproject.org?subject=unsubscribe>
List-Post: <mailto:predisclosure-applications@lists.xenproject.org>
List-Help: <mailto:predisclosure-applications-request@lists.xenproject.org?subject=help>
List-Subscribe: <https://lists.xenproject.org/mailman/listinfo/predisclosure-applications>, 
 <mailto:predisclosure-applications-request@lists.xenproject.org?subject=subscribe>
Errors-To: predisclosure-applications-bounces@lists.xenproject.org
Precedence: list
Sender: "Predisclosure-applications"
 <predisclosure-applications-bounces@lists.xenproject.org>
Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=selector1 header.d=citrix.com header.i="@citrix.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck"
ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none;
 b=jF1dcF6iarNRpDJMqHtxma3KciG1W8QMO52OKwomjtjykPV1dNWFBUo8mQt2xDEbfxjSa6GuI4rdbynPLI25Hq+geE3FVp8yS9GrNGWlLe32dVw50SdzSXBUkxFXlb1HVyLjMgBIoPDSjMGLST+46Am5bE0TFi4ihXsg8fb3laaH7BjX9ic6teQDHzVgVwf+nZtyZQF1oDMLlD7uOic/mUI2tJ0OLQf1zH75DNVulHlq/tBLkz7QOH+a8wgip/glGxM01dhg4zUTxLGI9uUgPQP8UI0B05vS2pt97bn4iMIK2TKRYnESgJ28HsIwFPuvOCd9lNrDspF0gLT7yYGR+Q==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
 s=arcselector10001;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
 bh=2G8sFkicLJnA2iOT/JuNAEwAQXY+RY0WdQKOdD37uNw=;
 b=A91rsRV/RFlCPSKIGFMkUP/0g99TOEOry5+1QOZAct8uQg3De9nikRz0bHsecpx3fkn1Q0EJLXHesfsumJgOSne0WBTLe5E86fUvEePKFvXw64BjW4Gkjp45FUDTMx2LQ5F6iAq3ay63RdnZKhE1kXfQFYtrEeyxqoEeT61CAqgM2I9bpN/OUzz2CiUB+LmEB/vXA/YBalLZ17S550n0dlvG+f1gHIiM+Qsrkj0CFOdqlT3ORnoEB2A03nPZobwLgccMx8tlHVHCEhdFNmAx+doXx3TctUc1Cvum8Nn7eUg1zRwPOqLo0qWOTrhGYbdiEekxTr45Ri52JCZuY1gSFQ==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass
 smtp.mailfrom=citrix.com; dmarc=pass action=none header.from=citrix.com;
 dkim=pass header.d=citrix.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=citrix.com;
 s=selector1;
 h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
 bh=2G8sFkicLJnA2iOT/JuNAEwAQXY+RY0WdQKOdD37uNw=;
 b=aemtz554xSOHRbPg5Ob1+YDDKlnF70JVMI8j8EwvGZPdgssnONthvfgu4umKWy/VtQLAcRhotTUk35xRJP+eyT1ZikxUid1tdaic20vlKLJIyXPBdvNq7z6GJcuETqOF2cfIyzgiXCJizN6ImMP3jwP4BLJs2HpNY0sDK7plipE=
From: Alex Brett <alex.brett@citrix.com>
To: "predisclosure-applications@lists.xenproject.org"
	<predisclosure-applications@lists.xenproject.org>
CC: Darryl Voss <Darryl@epic.com>, Jake Vondra <jvondra@epic.com>
Subject: Re: Epic Hosting - Xen Pre-Disclosure Submission
Thread-Topic: Epic Hosting - Xen Pre-Disclosure Submission
Thread-Index: AdzuwttRETC9w6WvTPmhZ/dQ5WoDwBbycQnM
Date: Tue, 22 Sep 2026 12:21:28 +0000
Message-ID:
 <CH7PR03MB785965097A6E3D6795C695ACE3832@CH7PR03MB7859.namprd03.prod.outlook.com>
References:
 <PH7PR17MB7026055FE84CA4E46DDE1BEBC0092@PH7PR17MB7026.namprd17.prod.outlook.com>
In-Reply-To:
 <PH7PR17MB7026055FE84CA4E46DDE1BEBC0092@PH7PR17MB7026.namprd17.prod.outlook.com>
Accept-Language: en-GB, en-US
Content-Language: en-GB
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
msip_labels:
authentication-results: dkim=none (message not signed)
 header.d=none;dmarc=none action=none header.from=citrix.com;
x-ms-publictraffictype: Email
x-ms-traffictypediagnostic: CH7PR03MB7859:EE_|CH2PR03MB5239:EE_
x-ms-office365-filtering-correlation-id: 3a2a5f31-adb8-47c9-cb5f-08df18a40732
x-ms-exchange-senderadcheck: 1
x-ms-exchange-antispam-relay: 0
x-microsoft-antispam:
 BCL:0;ARA:13230040|376014|23010399003|366016|1800799024|38070700021|56012099006|11063799006|10067099003|22082099003|18002099003|8096899003|13003099007|3023799007;
x-microsoft-antispam-message-info:
 D+skfyaquEhap5V1HnEUDBBySFOKm6byuX/J3LarcY7l9ejT36WtOVV1TkNDgmbupNbBu4j/LuZcCJFggBvsiCnMqy2dXdfZKcINcZ1gVHI1d2/N4Cibdq3R+c78nEi1gqWYB9eCJ43lDvORPZcaelNvnCBBQdhAc3xNpg2c2mPIeJv1US3n8o+2lZhMcDXQ0WuAR/obqUAB1x2QVmsbUh/3a2rnUD351xjDkwi4FfE4U8XdpSktSedxFG97GVrf3GD5ik04XkArfQeyYA1M3T9CX6an19loEHhV3kjshS7LqN+M+t9L8EIYFAihN3uXQlEL3mAOxp8xVd0RogGt1gO2EKPmPjNq1P3ODfU7T4fvWzUTAUuId8+wF92Zdq8TBEjxRDqyBsbadllnMJpaoor3h+bRurfRvTX+G4L2qt+gzfi5Q+ZqHAMoJeDv5TuCyI6RPm/4j/csRKbK4jzpKybaFRvdzVX/oFVlk8oCE0cv6n8sR1VrQK+8GQ6mNTKaHrrSOUlbQs3GpEmAppUjePJ+POlsv7ezgKwO/f6MOdky57P10n57fVahhv3m1n+MV9kb0UiK9u8LQehDKCbYGym3Lkjb7t5Vr8aEwU7WqUhqczL4+nIFSNh589dnal2lblafRDva9lLMdJqMX6U9EKYzM3XWVpePscKUwWl5FtI=
x-forefront-antispam-report:
 CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH7PR03MB7859.namprd03.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(38070700021)(56012099006)(11063799006)(10067099003)(22082099003)(18002099003)(8096899003)(13003099007)(3023799007);DIR:OUT;SFP:1101;
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0:
 =?Windows-1252?Q?iRxFlFz1A396p+/fsTzDolWYPfQ+lbrTFEfQj0no/KW8T+g35DiRFMMz?=
 =?Windows-1252?Q?yWDGXlziHNjNIwkrYqZYc5Y9spYdYBSukdxl+QEgOJJjOoGJDrM1SqF6?=
 =?Windows-1252?Q?TrQ76iQ6GA8yYILsl5KKE9YGiPcqkFh6753FDLnprVubbsCgOMuYmfEW?=
 =?Windows-1252?Q?N+xpem6rGBuqOeAlRS7bCbiSAHOQkX04TNOiCwe2fdWDBIUevvoclGoV?=
 =?Windows-1252?Q?ZudknF4nc8P7y+IX82j0QWVLHmgJEGDhj4qhJ3ABYuN91I0BM6gJWes9?=
 =?Windows-1252?Q?6V8+nyToORuAyGlqe6wy+v3auFhOm4qttHejGQJEA6IqtIqWYcnfpd3N?=
 =?Windows-1252?Q?QyXrEiH2dcWndc2vcr35oasocsu6jRNFySqAN8Qx3Ic5syyMOXkxfxTl?=
 =?Windows-1252?Q?Hp+p0QF/G2wIyxccBj8jub9fdeO0rsxfChyMO587FA5dnJt4eBqmuFfw?=
 =?Windows-1252?Q?xFvnsDF7tLuoO5eIpplsMIVAAzmO/vR5802Sy5b6U0mSxzj1/zsdc3ad?=
 =?Windows-1252?Q?C0wJbyylyvBeVTl3LdMusFBWYHX693A5pC0+8+aaLCnc+ljsjSZP1pD6?=
 =?Windows-1252?Q?1bw+gFbZ2hv5RLwdY3T2eYjM6f2m54NTrISNW5tNCAYScUs7raVbT56O?=
 =?Windows-1252?Q?o3YVvZZOSHW4dhZ0daICdNV+0UUO3+Mdz5guIVSa/nh+aYg9blDBRAMY?=
 =?Windows-1252?Q?ZM9C/9NzIpm/hDzgyE2dsyAQ5zQANctOinCYoJ7mgrk8jLl5esg913dv?=
 =?Windows-1252?Q?emj6AJHbXJ35XFAt8QBWLKDpPZpeV4zJ4W+U1a8ppoS021DWbXqWdMbJ?=
 =?Windows-1252?Q?tBt5hGO/AWWnsQBqk0IfvaiPMNXWh/U3HPoWDzDiX6pe4FnoaU4Dnfcy?=
 =?Windows-1252?Q?M66LR2HLZy8y2KzcNEoa+1MnO2CtcG14PCsYj8sDGugkYwC+9dCKDOE/?=
 =?Windows-1252?Q?ubvo+LO4pf89BJJ8slYPyKDh6RvRpCUehoBbLy6G94sV6asJ2zncGixQ?=
 =?Windows-1252?Q?Ho/vL0RcTQZiRAIGKYrBW4SpX7ywO8lSS3ZQg/MsqpRZrLBtSXj+nq3+?=
 =?Windows-1252?Q?5v9FVvAZf6AGNxONHiJS7/QByk+HV123MRFYTQ2XTeHx+Mec0LsSYTIa?=
 =?Windows-1252?Q?hT/XB+fqUsrk+bEkF8R5KzXJtm1dgRJY/tfGbj7yGvMQ3DYxxeJOAfXx?=
 =?Windows-1252?Q?wDH/JPmgUa9lXQyPgtRp0OYs+AQWAa5iKHKN6QCwB8BoCBeq8LGMtZeK?=
 =?Windows-1252?Q?c+BOUsUZm0F3DCJhGadVzfgo1K08zSV14xOCrfjUOsX6sQKLQg5hyQc1?=
 =?Windows-1252?Q?Khh0FOzmOFb6wIc2yQE/9bRg8eARJcWbf/3nJENuV3LDt5bwKMFDadeQ?=
 =?Windows-1252?Q?voxjqjAouLikiOEZAnxTUafquEosUNY7yPXu51T9ob5BLd9Qdkaddnac?=
 =?Windows-1252?Q?tdIYMWMUT2wufJbZ2as3tL1EKlkbUEuyd8rgSAQgQkGV9g/puHO5iY0D?=
 =?Windows-1252?Q?uxEg5vsG1MLItD4hgE/yvxuf2dNL5NfB+JZkQxDnkLcEjhaEEhhEFYPR?=
 =?Windows-1252?Q?JMQ/bNOaT2dJrP4bo9+k9eAKHza9VAdsCpzJNKO0dGV97GZBzNovirfa?=
 =?Windows-1252?Q?w3XTkntg9GkkNOoMxEKc0Vj2v/KcNsVmfoMOait+C1h/W9BwPHTisDQJ?=
 =?Windows-1252?Q?k6WPJ3c6An0CH1BM0H7s/u7rnmimCilEtjiLUykhI731vJ83LgX5mRsr?=
 =?Windows-1252?Q?nXuCy4UIWz5XcEVPKyjyoYFURfEF/JZ6qilGi9kS+Amu7hgVW8jvTaYP?=
 =?Windows-1252?Q?fFva3ATEGon7CwiK0j+I6XyU++ZbmDDlnwHwc45YMLLew1iTGQZdE0yJ?=
 =?Windows-1252?Q?wUMzV+PY5NYYAQ=3D=3D?=
Content-Type: multipart/alternative;
	boundary="_000_CH7PR03MB785965097A6E3D6795C695ACE3832CH7PR03MB7859namp_"
MIME-Version: 1.0
X-OriginatorOrg: citrix.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: CH7PR03MB7859.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 3a2a5f31-adb8-47c9-cb5f-08df18a40732
X-MS-Exchange-CrossTenant-originalarrivaltime: 22 Sep 2026 12:21:28.3980
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 335836de-42ef-43a2-b145-348c2ee9ca5b
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: U2LaiatV1QTdgyc3UwwclRIVoeTpUygt+Hfq77IBwJkz/rDwzzpD1MhFY/GvGmLmZeLCuaXBiUItT4d5Tvi3XA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH2PR03MB5239
X-purgate-ID: tlsNG-4011c0/1790079692-536D6CFC-F599FE68/0/0
X-purgate-type: clean
X-purgate-size: 10774

--_000_CH7PR03MB785965097A6E3D6795C695ACE3832CH7PR03MB7859namp_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

Hello Xen security team,

On behalf of Citrix / XenServer, and as per the in-person discussion at Xen=
 Summit in Munich, I can confirm that Epic Hosting LLC are a XenServer user=
, and in our opinion qualify as a "Large-scale organisational user of Xen" =
and thus should be added to the pre-disclosure list.

Many thanks,
Alex Brett
Chief Engineer, XenServer
________________________________
From: Jake Vondra <jvondra@epic.com>
Sent: 28 May 2026 18:00
To: predisclosure-applications@lists.xenproject.org <predisclosure-applicat=
ions@lists.xenproject.org>
Cc: Darryl Voss <Darryl@epic.com>; Alex Brett <alex.brett@citrix.com>
Subject: Epic Hosting - Xen Pre-Disclosure Submission


I am writing to request an addition to the Pre-Disclosure program =96 my re=
sponses to the requested prompts are in bold below.



  *   The name of your organization: Epic Hosting LLC
  *   Domain name(s) which you use to provide Xen software/services: epicho=
sted.com
  *   A brief description of why you fit the criteria: we are a large scale=
 enterprise delivering our integrated healthcare software
  *   If not all of your products/services use Xen, a list of (some of) you=
r products/services (or categories thereof) which do: we largely deliver th=
e application presentation layer via XenServer
  *   Link(s) to current public web pages, belonging to your organisation, =
for each of following pieces of information:
     *   Evidence of your status as a service/software provider: https://ww=
w.epic.com/
     *   If you are a public hosting provider, your public rates or how to =
get a quote: NA
     *   If you are a software provider, how your software can be downloade=
d or purchased: https://www.epic.com/contact/
  *   If you are an open-source project, a mailing list archive and/or vers=
ion control repository, with active development: NA
  *   Evidence of your status as a user/distributor of Xen: NA
     *   Statements about, or descriptions of, your eligible production ser=
vices or released software, from which it is immediately evident that they =
use Xen.
  *   Information about your handling of security problems: https://www.epi=
c.com/epic/page/reporting-potential-security-vulnerability/
     *   Your invitation to members of the public, who discover security pr=
oblems with your products/services, to report them in confidence to you;
     *   Specifically, the contact information (email addresses or other co=
ntact instructions) which such a member of the public should use.
  *   A statement to the effect that you have read this policy and agree to=
 abide by the terms for inclusion in the list, specifically the requirement=
s to regarding confidentiality during an embargo period: Acknowledged =96 t=
his has been reviewed
  *   The single (non-personal) email alias you wish added to the predisclo=
sure list: XenServer-Notices@epic.com<mailto:XenServer-Notices@epic.com>



Regards,

Jake Vondra

Epic | Hosting | 608-271-9000



--_000_CH7PR03MB785965097A6E3D6795C695ACE3832CH7PR03MB7859namp_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable

<html>
<head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252">
<style type=3D"text/css" style=3D"display:none;"> P {margin-top:0;margin-bo=
ttom:0;} </style>
</head>
<body dir=3D"ltr">
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Hello Xen security team,</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
On behalf of Citrix / XenServer, and as per the in-person discussion at Xen=
 Summit in Munich, I can confirm that Epic Hosting LLC are a XenServer user=
, and in our opinion qualify as a &quot;Large-scale organisational user of =
Xen&quot; and thus should be added to the
 pre-disclosure list.</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
<br>
</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Many thanks,</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Alex Brett</div>
<div class=3D"elementToProof" style=3D"font-family: Aptos, Aptos_EmbeddedFo=
nt, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; c=
olor: rgb(0, 0, 0);">
Chief Engineer, XenServer</div>
<div id=3D"appendonsend"></div>
<hr style=3D"display:inline-block;width:98%" tabindex=3D"-1">
<div id=3D"divRplyFwdMsg" dir=3D"ltr"><font face=3D"Calibri, sans-serif" st=
yle=3D"font-size:11pt" color=3D"#000000"><b>From:</b> Jake Vondra &lt;jvond=
ra@epic.com&gt;<br>
<b>Sent:</b> 28 May 2026 18:00<br>
<b>To:</b> predisclosure-applications@lists.xenproject.org &lt;predisclosur=
e-applications@lists.xenproject.org&gt;<br>
<b>Cc:</b> Darryl Voss &lt;Darryl@epic.com&gt;; Alex Brett &lt;alex.brett@c=
itrix.com&gt;<br>
<b>Subject:</b> Epic Hosting - Xen Pre-Disclosure Submission</font>
<div>&nbsp;</div>
</div>
<style>
<!--
@font-face
	{font-family:"Cambria Math"}
@font-face
	{font-family:Aptos}
@font-face
	{font-family:"Arial Black"}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
	{margin:0in;
	font-size:12.0pt;
	font-family:"Aptos",sans-serif}
a:link, span.x_MsoHyperlink
	{color:#467886;
	text-decoration:underline}
span.x_EmailStyle17
	{font-family:"Aptos",sans-serif;
	color:windowtext}
p.x_xmsonormal, li.x_xmsonormal, div.x_xmsonormal
	{margin:0in;
	font-size:12.0pt;
	font-family:"Aptos",sans-serif}
.x_MsoChpDefault
	{}
@page WordSection1
	{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
	{}
ol
	{margin-bottom:0in}
ul
	{margin-bottom:0in}
-->
</style>
<div lang=3D"EN-US" link=3D"#467886" vlink=3D"#96607D" style=3D"word-wrap:b=
reak-word">
<div class=3D"x_WordSection1">
<p class=3D"x_MsoNormal">I am writing to request an addition to the Pre-Dis=
closure program =96 my responses to the requested prompts are in bold below=
.</p>
<p class=3D"x_MsoNormal">&nbsp;</p>
<ul type=3D"disc" style=3D"margin-top:0in">
<li class=3D"x_xmsonormal" style=3D"">The name of your organization: <b>Epi=
c Hosting LLC</b></li><li class=3D"x_xmsonormal" style=3D"">Domain name(s) =
which you use to provide Xen software/services:
<b>epichosted.com</b></li><li class=3D"x_xmsonormal" style=3D"">A brief des=
cription of why you fit the criteria:
<b>we are a large scale enterprise delivering our integrated healthcare sof=
tware</b></li><li class=3D"x_xmsonormal" style=3D"">If not all of your prod=
ucts/services use Xen, a list of (some of) your products/services (or categ=
ories thereof) which do:
<b>we largely deliver the application presentation layer via XenServer</b><=
/li><li class=3D"x_xmsonormal" style=3D"">Link(s) to current public web pag=
es, belonging to your organisation, for each of following pieces of informa=
tion:</li><ul type=3D"disc" style=3D"margin-top:0in">
<li class=3D"x_xmsonormal" style=3D"">Evidence of your status as a service/=
software provider:
<b><a href=3D"https://www.epic.com/">https://www.epic.com/</a></b> </li><li=
 class=3D"x_xmsonormal" style=3D"">If you are a public hosting provider, yo=
ur public rates or how to get a quote:
<b>NA</b></li><li class=3D"x_xmsonormal" style=3D"">If you are a software p=
rovider, how your software can be downloaded or purchased:
<b><a href=3D"https://www.epic.com/contact/">https://www.epic.com/contact/<=
/a></b></li></ul>
<li class=3D"x_xmsonormal" style=3D"">If you are an open-source project, a =
mailing list archive and/or version control repository, with active develop=
ment:
<b>NA</b></li><li class=3D"x_xmsonormal" style=3D"">Evidence of your status=
 as a user/distributor of Xen:<b> NA</b></li><ul type=3D"disc" style=3D"mar=
gin-top:0in">
<li class=3D"x_xmsonormal" style=3D"">Statements about, or descriptions of,=
 your eligible production services or released software, from which it is i=
mmediately evident that they use Xen.</li></ul>
<li class=3D"x_xmsonormal" style=3D"">Information about your handling of se=
curity problems:
<b><a href=3D"https://www.epic.com/epic/page/reporting-potential-security-v=
ulnerability/">https://www.epic.com/epic/page/reporting-potential-security-=
vulnerability/</a></b></li><ul type=3D"disc" style=3D"margin-top:0in">
<li class=3D"x_xmsonormal" style=3D"">Your invitation to members of the pub=
lic, who discover security problems with your products/services, to report =
them in confidence to you;</li><li class=3D"x_xmsonormal" style=3D"">Specif=
ically, the contact information (email addresses or other contact instructi=
ons) which such a member of the public should use.</li></ul>
<li class=3D"x_xmsonormal" style=3D"">A statement to the effect that you ha=
ve read this policy and agree to abide by the terms for inclusion in the li=
st, specifically the requirements to regarding confidentiality during an em=
bargo period:
<b>Acknowledged =96 this has been reviewed</b></li><li class=3D"x_xmsonorma=
l" style=3D"">The single (non-personal) email alias you wish added to the p=
redisclosure list:<b>
<a href=3D"mailto:XenServer-Notices@epic.com"><span style=3D"color:windowte=
xt; text-decoration:none">XenServer-Notices@epic.com</span></a></b></li></u=
l>
<p class=3D"x_MsoNormal">&nbsp;</p>
<p class=3D"x_MsoNormal">Regards,</p>
<p class=3D"x_MsoNormal" style=3D""><b>Jake Vondra</b></p>
<p class=3D"x_MsoNormal"><i><span style=3D"font-size:10.0pt; font-family:&q=
uot;Arial Black&quot;,sans-serif; color:red">Epic</span></i><i><span style=
=3D"font-size:10.0pt; font-family:&quot;Arial Black&quot;,sans-serif">
</span></i><span style=3D"font-size:10.0pt">| Hosting | 608-271-9000</span>=
</p>
<p class=3D"x_MsoNormal">&nbsp;</p>
</div>
</div>
</body>
</html>

--_000_CH7PR03MB785965097A6E3D6795C695ACE3832CH7PR03MB7859namp_--


From predisclosure-applications-bounces@lists.xenproject.org Thu Sep 24 17:45:05 2026
Return-path: <predisclosure-applications-bounces@lists.xenproject.org>
Envelope-to: archives@lists.xenproject.org
Delivery-date: Thu, 24 Sep 2026 17:45:05 +0000
Received: from list by lists.xenproject.org with outflank-mailman.1432780.1653809 (Exim 4.92)
	(envelope-from <predisclosure-applications-bounces@lists.xenproject.org>)
	id 1x9nVH-000260-2m; Thu, 24 Sep 2026 17:45:03 +0000
X-Outflank-Mailman: Message body and most headers restored to incoming version
Received: by outflank-mailman (output) from mailman id 1432780.1653809; Thu, 24 Sep 2026 17:45:03 +0000
Received: from localhost ([127.0.0.1] helo=lists.xenproject.org)
	by lists.xenproject.org with esmtp (Exim 4.92)
	(envelope-from <predisclosure-applications-bounces@lists.xenproject.org>)
	id 1x9nVG-00025w-W3; Thu, 24 Sep 2026 17:45:02 +0000
Received: by outflank-mailman (input) for mailman id 1432780;
 Thu, 24 Sep 2026 17:44:39 +0000
Received: from mail.xenproject.org ([104.130.215.37])
 by lists.xenproject.org with esmtp (Exim 4.92)
 (envelope-from <andrew@xen.org>) id 1x9nUt-00023q-NF
 for predisclosure-applications@lists.xenproject.org;
 Thu, 24 Sep 2026 17:44:39 +0000
Received: from xenbits.xenproject.org ([104.239.192.120])
 by mail.xenproject.org with esmtp (Exim 4.96)
 (envelope-from <andrew@xen.org>) id 1x9nUt-00FgPP-00;
 Thu, 24 Sep 2026 17:44:39 +0000
Received: from host-78-146-248-75.as13285.net ([78.146.248.75]
 helo=[192.168.1.51])
 by xenbits.xenproject.org with esmtpsa (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96)
 (envelope-from <andrew@xen.org>) id 1x9nUt-002pbr-20;
 Thu, 24 Sep 2026 17:44:39 +0000
X-BeenThere: predisclosure-applications@lists.xenproject.org
List-Id: Applications for membership of Xen Security Advisories Pre-disclosure
 List <predisclosure-applications.lists.xenproject.org>
List-Unsubscribe: <https://lists.xenproject.org/mailman/options/predisclosure-applications>, 
 <mailto:predisclosure-applications-request@lists.xenproject.org?subject=unsubscribe>
List-Post: <mailto:predisclosure-applications@lists.xenproject.org>
List-Help: <mailto:predisclosure-applications-request@lists.xenproject.org?subject=help>
List-Subscribe: <https://lists.xenproject.org/mailman/listinfo/predisclosure-applications>, 
 <mailto:predisclosure-applications-request@lists.xenproject.org?subject=subscribe>
Errors-To: predisclosure-applications-bounces@lists.xenproject.org
Precedence: list
Sender: "Predisclosure-applications"
 <predisclosure-applications-bounces@lists.xenproject.org>
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xen.org;
	s=20200302mail; h=Content-Transfer-Encoding:Content-Type:In-Reply-To:From:
	References:To:Subject:Cc:MIME-Version:Date:Message-ID;
	bh=CNZfPYmhO/QTVKmcKyD3YLpOV7mHEecPBL+iNwx9cDY=; b=I4UyCHIntIU0LKOZRfAeKwoif6
	GBJxm6+cPDjLm5aR3y+5dG30QKfshEwwPEB3uziJHufSgEuL7AuI0XH3XTzIEmC1JrpEOsbpX/+4E
	ugrjx4r03HPbzsq9qVXR0NVpnDH4IPf4BMJ9HWEPpp3it5cfKK45dCDZIoMqkfQrjaqc=;
Message-ID: <f0ef4781-8c51-436d-ae9c-33b45206fd47@xen.org>
Date: Thu, 24 Sep 2026 18:44:37 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Cc: Darryl Voss <Darryl@epic.com>, Jake Vondra <jvondra@epic.com>
Subject: Re: Epic Hosting - Xen Pre-Disclosure Submission
To: Alex Brett <alex.brett@citrix.com>,
 "predisclosure-applications@lists.xenproject.org"
 <predisclosure-applications@lists.xenproject.org>
References: <PH7PR17MB7026055FE84CA4E46DDE1BEBC0092@PH7PR17MB7026.namprd17.prod.outlook.com>
 <CH7PR03MB785965097A6E3D6795C695ACE3832@CH7PR03MB7859.namprd03.prod.outlook.com>
Content-Language: en-GB
From: Andrew Cooper <andrew@xen.org>
In-Reply-To: <CH7PR03MB785965097A6E3D6795C695ACE3832@CH7PR03MB7859.namprd03.prod.outlook.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thankyou,

Per the discussion at XenSummit, we consider this sufficient confirmation.

~Andrew

On 22/09/2026 1:21 pm, Alex Brett wrote:
> Hello Xen security team,
>
> On behalf of Citrix / XenServer, and as per the in-person discussion
> at Xen Summit in Munich, I can confirm that Epic Hosting LLC are a
> XenServer user, and in our opinion qualify as a "Large-scale
> organisational user of Xen" and thus should be added to the
> pre-disclosure list.
>
> Many thanks,
> Alex Brett
> Chief Engineer, XenServer
> ------------------------------------------------------------------------
> *From:* Jake Vondra <jvondra@epic.com>
> *Sent:* 28 May 2026 18:00
> *To:* predisclosure-applications@lists.xenproject.org
> <predisclosure-applications@lists.xenproject.org>
> *Cc:* Darryl Voss <Darryl@epic.com>; Alex Brett <alex.brett@citrix.com>
> *Subject:* Epic Hosting - Xen Pre-Disclosure Submission
>  
>
> I am writing to request an addition to the Pre-Disclosure program – my
> responses to the requested prompts are in bold below.
>
>  
>
>   * The name of your organization: *Epic Hosting LLC*
>   * Domain name(s) which you use to provide Xen software/services:
>     *epichosted.com*
>   * A brief description of why you fit the criteria: *we are a large
>     scale enterprise delivering our integrated healthcare software*
>   * If not all of your products/services use Xen, a list of (some of)
>     your products/services (or categories thereof) which do: *we
>     largely deliver the application presentation layer via XenServer*
>   * Link(s) to current public web pages, belonging to your
>     organisation, for each of following pieces of information:
>       o Evidence of your status as a service/software provider:
>         *https://www.epic.com/*
>       o If you are a public hosting provider, your public rates or how
>         to get a quote: *NA*
>       o If you are a software provider, how your software can be
>         downloaded or purchased: *https://www.epic.com/contact/*
>   * If you are an open-source project, a mailing list archive and/or
>     version control repository, with active development: *NA*
>   * Evidence of your status as a user/distributor of Xen:*NA*
>       o Statements about, or descriptions of, your eligible production
>         services or released software, from which it is immediately
>         evident that they use Xen.
>   * Information about your handling of security problems:
>     *https://www.epic.com/epic/page/reporting-potential-security-vulnerability/*
>       o Your invitation to members of the public, who discover
>         security problems with your products/services, to report them
>         in confidence to you;
>       o Specifically, the contact information (email addresses or
>         other contact instructions) which such a member of the public
>         should use.
>   * A statement to the effect that you have read this policy and agree
>     to abide by the terms for inclusion in the list, specifically the
>     requirements to regarding confidentiality during an embargo
>     period: *Acknowledged – this has been reviewed*
>   * The single (non-personal) email alias you wish added to the
>     predisclosure list:*XenServer-Notices@epic.com
>     <mailto:XenServer-Notices@epic.com>*
>
>  
>
> Regards,
>
> *Jake Vondra*
>
> /Epic///| Hosting | 608-271-9000
>
>  
>



