Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000

Vercel confirmed a KVM zero-day allowing a full virtual-machine escape, after researcher Paulos Yibelo demonstrated guest-to-host root access through its bug bounty program. The company awarded a $50,000 bounty; the flaw threatens the security boundary used to contain untrusted sandbox workloads.