Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000

What happened?

Vercel has confirmed a KVM zero-day vulnerability after security researcher Paulos Yibelo reported a full virtual machine escape that, he says, allows code inside a guest to gain root access on the host. Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon pic.twitter.com/dt9AsDO0De — Paulos Yibelo (@PaulosYibelo) October 3, 2026 The discovery came through the Vercel Sandbox bug bounty program, raising concerns about a security boundary used to contain untru

Key details

• Vercel confirmed a KVM zero-day vulnerability after researcher Paulos Yibelo reported a full VM escape.
• The exploit allegedly allows guest code to gain root access on the host system.
• Yibelo announced the finding on October 3, 2026, calling it a full VM escape zeroday.
• Vercel awarded Yibelo $50,000, the maximum bounty for one report.
• The bug bounty program focuses on microVM escapes to an EC2 host and cross-customer data access.
• Vercel's architecture uses Firecracker microVMs on bare-metal EC2 hosts as the primary security boundary.
• No CVE, affected versions, processor requirements, or patch have been disclosed yet.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.