[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgqBvyMHM4dM1e7Fb99cLkM-WUu9xXTt2ovidzsjjkiw":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"cb3f33dc-e8a4-4393-b0e5-d1000cfcde30","Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory","critical-pwnescape-linux-kernel-vulnerability-lets-guest-vms-read-host-memory-e2089d","A newly disclosed critical flaw in the Linux kernel allows code inside a virtual machine to read memory on the host computer it runs on. A researcher demonstrated the leak against Vercel's live cloud sandboxes, and Vercel confirmed it. The flaw, now tracked as CVE-2026-99999 and nicknamed PwnEscape, is in the Linux kernel's networking code, not in any one cloud's setup, so it reaches the shared","A critical vulnerability, dubbed PwnEscape and tracked as CVE-2026-99999, has been discovered in the Linux kernel's networking code. This flaw enables code running within a virtual machine to access and read memory from the host system. A researcher successfully demonstrated this memory leak against Vercel's cloud sandboxes, a risk that Vercel has acknowledged.","Linux kernel vulnerability PwnEscape allows guest VMs to read host memory.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcritical-pwnescape-linux-kernel.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEi0Y0ZP5acV4vjjJV9at7yMnz0frJTAeLd3nGmqMIcifTwGoe2NsB7pDInUjGa6aocyqoM3o-NyXKpsfyy1LRdkH5UG67UVYC_lNZDYArvg-hkmtifcalWo67Mkl3A4_2qwXomi7iJURUjoiSlBdEWtJL5N63jfuMDjI7ewZHLlTZBXlkc4zqwyxKox7eE\u002Fs1600\u002Fpwnescape-main.jpg","2026-10-15T20:24:36+00:00","2026-10-15T22:00:14.248864+00:00",9,[17,20],{"name":18,"type":19},"Vercel","vendor",{"name":21,"type":22},"Linux kernel","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[42],{"type":43,"value":44,"context":45},"cve","CVE-2026-99999","PwnEscape Linux kernel vulnerability",[18],{"controls":48,"vendors":136},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":79,"name":80,"problem":81,"products":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":108,"name":109,"problem":110,"products":111},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[112,120,128],{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",[],{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":152},"pwnescape-linux-kernel-flaw-allows-guest-vms-to-read-host-memory","PwnEscape: Linux Kernel Flaw Allows Guest VMs to Read Host Memory","CVE-2026-99999 (PwnEscape) exposes a critical flaw in the Linux kernel's networking code that breaks the fundamental security boundary between virtual machines and their host systems. A successful exploit allows malicious or compromised guest VM code to read arbitrary host memory, potentially exposing secrets, credentials, encryption keys, and data belonging to other tenants in a shared cloud environment. This is especially dangerous in multi-tenant cloud platforms like Vercel's sandboxes, where workload isolation is a core security promise. The vulnerability undermines hypervisor-level trust assumptions and demonstrates that kernel-level bugs can cascade into full environment escapes. Prompt patching and robust VM isolation architecture are essential to contain the blast radius of such flaws.",[142,143,144,145,146,147,148,149,150,151],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-39: Process Isolation","NIST SP 800-53 CA-7: Continuous Monitoring","NIST SP 800-125: Guide to Security for Full Virtualization Technologies","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","ITIL Change Management: Emergency Change Procedure","GDPR Article 32: Security of Processing (Technical Measures)",{}]