KVM 0-day vulnerability confirmed in Vercel Sandbox bounty program

A KVM 0-day vulnerability was confirmed in 2026 through the Vercel Sandbox bounty program, affecting the industry’s "gold standard" Linux virtualization solution. The discovery was aided by Paulos and other researchers; the report will be published in detail later and poses a significant security risk to sandboxes and agents.