The vulnerability impacts a tool described as the industry's gold standard for Linux virtualization, and experts warn that the blast radius of the bug is huge. Vercel is using the discovery to harden the sandbox environment for its AI agents and will publish a full technical writeup of the exploit.
Tuesday, October 20, 2026
Story
Vercel Confirms KVM 0day Allows Full VM Escape to Host Root
Cybersecurity17 days ago
Security researchers found a flaw in a widely used Linux virtualization tool that gives a guest user a path to take over the physical hardware from within a virtual machine. Vercel confirmed the zero-day vulnerability in the Kernel-based Virtual Machine (KVM), which permits a full VM escape from guest to host root, after Paulos Yibelo and other researchers identified the issue through the company's Sandbox bounty program.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.