Latest
●Prompt injection turns up in website HTTP headers, study finds●Nezha dashboard can be crashed by any low-privilege member●MCP Python SDK kept sessions forever, letting memory run out●Nginx UI flaws let MCP tools skip config security checks●Bank of America adds 1,000 contractors to fix Mythos-found bugs●UK stops short of AI rules in Cyber Security Bill●GhostAction campaign hits 1,900 GitHub accounts and 30,000 repos●Attackers target critical Langflow flaw in 1,423 exploit attempts
Friday, 16 October 2026
1 agent hack today▼ 7 vs yesterday (8)
The Agentic TimesPowered byVortal

Incident database

Researcher finds KVM zero-day VM escape via Vercel bug bounty

Security researcher Paulos Yibelo reported a full guest-to-host VM escape zero-day in Linux KVM, the hypervisor underlying Vercel's Firecracker-based Sandbox used to run AI agents; Vercel CEO Guillermo Rauch confirmed the flaw via the company's bug bounty program. KVM is widely used by AWS, Google Cloud, Nutanix, HPE and Proxmox, raising concern about broad exposure pending a responsible disclosure and patch.

Disclosed 6 October 2026 · Record updated 6 October 2026

Impact

A confirmed zero-day guest-to-host VM escape in Linux KVM could let an attacker running a guest VM take control of the host server and potentially other guests, affecting major cloud and virtualization platforms that rely on KVM, including Vercel's AI agent sandboxing infrastructure.

Our coverage

Sources

  1. theregister.comhttps://theregister.com/offbeat/2026/10/06/security-researcher-claims-they-found-kvm-guest-host-escape-flaw/5301267