Guillermo Rauch, CEO of Vercel, announced that the Vercel Sandbox bounty program has confirmed a KVM zero-day vulnerability that impacts KVM, widely regarded as the industry’s gold‑standard Linux virtualization solution. Researcher Paulos Yibelo and others reported a full VM escape allowing guest→host root compromise in industry‑standard hypervisors, meaning a process or VM running inside the sandbox can break isolation and gain root on the host. Rauch credited the external researchers, emphasized the finding’s severity for sandboxes used by autonomous agents, and said a detailed writeup will be published.
The discovery underscores both the real risk posed by hypervisor escape bugs and the value of proactive bug‑bounty programs in finding them before abuse. Because KVM underpins many cloud, CI/CD and multi‑tenant environments, a guest→host root exploit demands immediate attention from operators: patching, risk‑mitigation, and reassessment of trust boundaries for sandboxed workloads. The announcement frames 2026 as a year of high‑impact security research and signals that further technical details and mitigations will be available once the full disclosure is released.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A 40ms pause in Go's garbage collector was caused by swap eviction of metadata pages during GC cycles. Page faults during stop-the-world pauses led to significant delays, highlighting risks of using swap in production for memory spikes. (frn.sh)
OpenAI is facing increasing legal risks after uncovering hacks related to its technology. The situation raises questions about liability for misuse of AI tools and cybersecurity breaches. (ft.com)
A researcher at a Russian plague laboratory in Siberia died from an unknown infection following a laboratory accident. Russian authorities have implemented special measures, but the exact nature of the released pathogen remains unclear. (scrippsnews.com)
European Commission staff dislike the EU's 'sovereign' backup platform Element Pro, calling it ineffective and poorly designed. The EC implemented it to reduce reliance on US tech, but staff skepticism remains high due to usability issues and concerns over data security. (gizmodo.com)
A researcher at a Russian plague laboratory has died from an unidentified infection. Authorities have not disclosed details about the cause of death or the infection. (cnn.com)
AI systems can trigger nuclear conflicts by amplifying human cognitive blind spots and overwhelming decision-makers during crises. Superintelligence is not necessary for AI to escalate nuclear risks, as current systems influence human judgment and actions. (thebulletin.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.