Today · October 14

Vercel's bounty finds a kernel zero-day; figures are its own

Vercel publishes the results of its US$1M sandbox bounty: a white hat found a Linux kernel zero-day that broke through its virtualization isolation, and Vercel CEO Guillermo Rauch says the flaw is patched. Vercel's official account wrote: "One Linux kernel zero day discovered • No reports of customer data compromise" (Vercel, 2026-10-14). Rauch says the white hat used a group of AI agents to find it (Guillermo Rauch, 2026-10-14). The bounty drew 1,285 reports and paid out US$242K, about a quarter of the cap. Vercel's blog says most major clouds use the same Linux kernel layer for isolation, and the vulnerability's identifier is awaiting publication (Vercel blog, 2026-10-14). All figures are Vercel's own, and whether the same vulnerability breaks through other providers has no third-party check. Our judgment: what was broken through is the isolation layer Vercel uses. If providers share the same kernel mechanism, they could in principle be exposed to the same class of vulnerability, but no third party has confirmed that. The reported sandbox security describes the state after patching. How we checked →

Concept illustration: a laptop sits on a white shelf between two white cubes, with a white placard in front bearing a black triangle and the lettering VERCEL. On the screen, a window shows a red frame labeled LINUX around a panel of gray lines; the frame's right side is cracked with pieces breaking off, an adhesive bandage covers the crack, and a red beetle sits beside the fragments.

Source and checks

This item ran in the brief of Oct 15, 2026, alongside 18 other items. How we checked it, the quote checks and what was still missing that day are on that issue's How we checked page.

Cite this item

SecondSource (2026). "Vercel's bounty finds a kernel zero-day; figures are its own." https://secondsource.io/en/product/2026-10-15-1/. Accessed access date.