TLDR Tech / News
Vercel Pays $50K for Unpatched KVM Exploit
A security researcher has been awarded $50,000 by Vercel through its bug bounty program for discovering a vulnerability that allows a guest virtual machine to gain root access to the host. This exploit affects widely used hypervisor technologies. The CEO of Vercel confirmed the existence of this zero-day flaw in the KVM, a component fundamental to many cloud and virtual private server infrastructures. As of early October 2026, no public CVE identifier, affected kernel version, patch, or detailed technical information has been released, leaving hosting providers anticipating a comprehensive disclosure.
Read the full story