Security Researcher Exploits Critical Linux Kernel Flaw via AI, Earns $50,000 Vercel Bounty

A researcher has demonstrated a critical vulnerability in Linux's networking stack that enables full escape from Vercel's production virtualization sandboxes, earning $50,000 from the company's bug bounty program. Security researcher Paulos Yibelo reported CVE-2026-99999, known as PwnEscape, a guest-to-host KVM escape with a 9.3 CVSS critical severity rating that allows code running inside a virtual machine to read and write host kernel memory, potentially gaining root access on the underlying server.