Firecracker MicroVM Escape Allows Root Code Execution on Host
Researchers escape Firecracker microVM and achieve root code execution on the host by modifying saved registers in pt_regs.
Stories per day · 30 days
3 RSS
Relatedkvm4vm-escape4linux3ai-agents2cve-2026-999992kernel2sandbox2vercel2cache1cloud1linux-kernel1micro-vm1microvm1openshift1open-source1perplexity1pwnescape1resctrl1
15 stories, newest first · one card per story
Stories tagged #firecracker
Tracekit Box runs AI agent jobs in networkless Firecracker micro-VMs
Host doors sign commands, connections, secrets, model calls and patches into one offline-verifiable .tkb bundle.
Runbook hardens shared Linux hosts against cache covert channels
The guide covers KVM, Firecracker and QEMU: separate cores, disable KSM, keep CPU mitigations, and partition L3 with resctrl.
Linux networking flaw lets KVM guests escape to the host
Pwn.ai leaked host memory on Vercel production sandboxes and gained root on lab hosts; guest-only updates do not fix it.
2
Perplexity Open-Sources SPACE, a Firecracker MicroVM Sandbox for AI Agents
Perplexity open-sourced SPACE, a Firecracker microVM sandbox for isolating AI agents.
2
Linux kernel gets a fix for a flaw that enabled attackers to escape VMs
Linux patched CVE-2026-99999, a networking flaw researchers used to escape VMs to the host.
13
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
Linux kernel flaw CVE-2026-99999 lets guest VMs read host memory, shown on Vercel sandboxes but not exploited in the wild.
Security researcher claims they found KVM guest-host escape flaw
Paulos Yibelo claims a KVM guest-to-host root escape zero-day found via Vercel’s Firecracker sandbox bounty.
13
Re: cloud computing provider disclosures
oss-security reply says Xen, KVM, QEMU, and Cloud Hypervisor already have separate disclosure processes.
Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000
Vercel confirmed researcher Paulos Yibelo's KVM zero-day guest-to-host root escape and paid a $50,000 bounty.
Cloudflare Containers Flaw Could Expose Data From Other Customers’ Workloads
Cloudflare patched a Containers disk-reuse flaw that could expose residual data from other customers' workloads.
3
Cloudflare Containers Vulnerability Could Leak Data Between Customer Workloads
Cloudflare patched a Containers flaw that could let one tenant read residual disk data from another.
7
Secure VMs for Kubernetes: Hardening Kata containers
A developer used AI agent Astra to cut ~60% of Kata Containers code, releasing a minimal-attack-surface fork for Kubernetes on Firecracker VMs.
1
$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.
5
The VMs Powering Mobile Agents (Instinct, Claude Code)
A teardown reveals Claude Code runs in Firecracker microVMs with a Rust PID 1 and MITM'd egress, while Instinct rents E2B sandboxes with git-based memory.
10