The vulnerability, named PwnEscape, was published on October 15. A separate researcher, 0x4d31, noted that they were able to rediscover the flaw in under 2 hours by using OpenAI's gpt-5.6-cyber model in a devbox. The rediscovery was triggered after the researcher identified the word "virtio" in a partially redacted Vercel bounty screenshot and provided that hint to the AI agent.
Tuesday, October 20, 2026
Story
PwnEscape's 9.3 CVSS KVM Flaw Gives VM Guests Root Host Control
Cybersecurity5 days ago
Security researchers have released the technical specifications for a vulnerability that allows code running in a virtual machine to take over the physical server it resides on. The flaw, tracked as CVE-2026-99999, affects multiple industry-standard hypervisors using the Linux kernel networking stack and carries a critical CVSS score of 9.3. Attackers exploiting the bug can move from untrusted VM code to perform host-kernel memory reads, controlled writes, and root command execution.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.