Xen Orchestra auth bypass exploited to take over XCP-ng hosts
A crafted empty-JSON cookie logs attackers in as an existing token owner; Vates fixed it in 6.9.1 and 6.10.0.
Stories per day · 30 days
3 RSS
Relatedvm-escape3authentication-bypass2citrix2cve2cve-2026-999992hypervisor2kvm2linux2linux-kernel2vates2xcp-ng2xen-orchestra2xenserver2broadcom1cloud1dell1denial-of-service1dpdk1
28 stories, newest first · one card per story
Stories tagged #virtualization
ESXi and Proxmox ransomware cases from misconfigured credentials
Attackers compromised hypervisors via monitoring tools and reused root passwords without VM escapes.
Linux kernel patch closes PwnEscape KVM guest-to-host escape
CVE-2026-99999 lets an x86 KVM guest alter already-validated IP packets, read host memory, and potentially run code.
8
Critical Linux Kernel Flaw Lets Attackers Escape Virtual Machines and Take Control of Hosts
Linux kernel flaw CVE-2026-99999 can let a guest VM leak host memory and, in a lab, run code on the host.
linux kernel: PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
A write-up claims Linux KVM guest-to-host escape CVE-2026-99999, so far described as host-memory disclosure.
Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
Citrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
DPDK security advisory: Multiple vulnerabilities in vhost/vhost-crypto/vDPA/GSO libraries
DPDK patched guest-triggerable memory-safety flaws in vhost, vhost-crypto, vDPA, and GSO.
Topgolf saved over $11.3M after leaving VMware
Topgolf reports more than $11.3 million saved after migrating from VMware to VergeOS.
Xen Security Advisory 522 v1 (CVE-2026-98375) - Linux xen-netfront: backend can crash guest via malformed RX packets
Xen XSA-522 warns a malicious backend can crash Linux guests via malformed xen-netfront packets, CVE-2026-98375.
PoC Released for Critical VMware VMXNET3 Flaw Enabling Guest-to-Host Code Execution
Public PoC for VMware CVE-2026-59346 crashes the host VMX process but does not prove code execution.
A Survey of Security Research for Operating Systems
Survey reviews OS virtualization, verification, and access control against reference-monitor requirements.
Security researcher claims they found KVM guest-host escape flaw
Paulos Yibelo claims a KVM guest-to-host root escape zero-day found via Vercel’s Firecracker sandbox bounty.
13
Meta Rushed to Fix Muse ‘VM Escape' Vulnerability Immediately Before Launch
Meta rushed fixes for Muse AI agent VM-escape flaws, including one that could reach Meta's sensitive internal databases, with engineers warning of a future breach.
Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000
Vercel confirmed researcher Paulos Yibelo's KVM zero-day guest-to-host root escape and paid a $50,000 bounty.
Linux KVM/x86 (tested on 6.1.74): guest-triggered host panic via SMM shadow MMU
A KVM x86 shadow-MMU bug lets an L1 guest panic the Linux host via nested VMX and SMM.
USN-8831-1: libvirt vulnerabilities
Ubuntu patched two local libvirt flaws: a possible code-execution overflow and a TPM log symlink bug.
Virtio-nvgpu: Near-native Nvidia GPU access inside a KVM guest
Open-source virtio-nvgpu project provides near-native Nvidia GPU access inside KVM virtual machine guests.
New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory
Linux kernel flaw CVE-2026-89775 lets ARM64 KVM guests read and write freed host memory, enabling guest-to-host escape.
3
CVE-2026-89775: Guest-to-Host Escape in KVM/arm64
Disclosed CVE-2026-89775 lets a guest VM escape to the host on KVM/arm64 systems with nested virtualization enabled.
You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers
Tirith replaces invasive kernel-level game anti-cheats with protected VMs and a dual-trusted virtualization monitor, preserving detection and near-native performance.
From Hypervisor to Container: Cloud Security Vulnerabilities, Defense Mechanisms, and Open Challenges
Survey of 120+ cloud security papers (2008-2025) reviews hypervisor and container isolation attacks, scoring defenses with the ADPO framework and CIA impact scale.
Scans for Proxmox Servers, (Wed, Sep 9th)
SANS observed increased scanning and brute-force attacks on port 8006 targeting unsupported Proxmox VE 7 servers after a recent vulnerability advisory.
2
ZDI-26-647: VMware Workstation VMXNET3 TSO Segmentation Integer Overflow Local Privilege Escalation Vulnerability
ZDI disclosed an integer overflow in VMware Workstation's VMXNET3 TSO code (CVE-2026-59346) enabling local privilege escalation.