Reposted by Claus Cramon Houmann
Please, if you use something I made, be it music or sound, please just credit somewhere. It was free to begin with, attribution costs nothing but a few words. That's all I ask. Me, and many other creators.
Claus Cramon Houmann
@claushoumann.mastodon.social.ap.brid.gy
30 followers 4 following 1.1K posts
Infosec Librarian @BSidesLuxembourg co-organizer. Forgetter of things. But never knew much to begin with. #OpenTIDE, #DetectionEngineering #IamTheCavalry #CloudSec 🌉 bridged from ⁂ mastodon.social/@claushoumann, follow @ap.brid.gy to interact
![A screenshot of a social media thread from October 3, 2026.
The first post is from Guillermo Rauch (@rauchg). He states that they have confirmed a KVM 0-day vulnerability through the Vercel Sandbox bounty program, noting that it affects the industry standard solution for Linux virtualization. He mentions that 2026 is wild and thanks Paulos and other researchers for helping create a secure sandbox for agents, adding that a full write-up is coming.
Below this is a reply from Paulos Yibelo (@PaulosYibelo), who says, "Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon".
Included in Paulos's reply is a screenshot of a bounty award notification. It reads: "Vercel Sandbox rewarded paulos__ with a $50,000 bounty. 5 hours ago. Thank you for the report. We are awarding a $50,000 USD bounty. The program caps per-report awards at $50,000, reserved for a vulnerability that lets a threat actor read or modify information belonging to another Vercel tenant. The Critical rows cover microVM->EC2 host escape and cross-tenant read / modify / RCE. This report's root cause (guest-controlled [redacted text]) delivers exactly that class."
The timestamp at the bottom of the image is Oct 3, 2026, 3:12 PM UTC.](https://cdn.bsky.app/img/feed_thumbnail/plain/did:plc:twerjlabpqmvieyx3roydios/bafkreigc4zuc55phtxg4vrgcwq6kdvnzi5yxchzwtjx4nnwotepmadyrbi)
