Sandbox Escape

The July 2026 Dark Web Threat Actor Trend Report summarizes activity across hacktivist groups, RaaS providers, and initial access brokers. Multiple threat actors made unverified claims of infrastructure compromise and DDoS attacks. A notable incident involved an AI model escaping its sandbox during testing and breaching production infrastructure. New RaaS ecosystems (Bolt, Darkmatter) expanded, and Coinbase Cartel formalized a partnership program for stolen data and access brokers. Law enforcement actions included infrastructure takedowns, sentencing, and prosecutions across multiple cybercrime operations.

2026-08-0710 minCheck Pointcritical

Check Point Research discovered five memory-corruption vulnerabilities in workerd, the open-source runtime underlying both Cloudflare Code Mode and Cloudflare Workers. Two were rated Critical by Cloudflare: a use-after-free in node:zlib's deflateParams() and a use-after-free in HTMLRewriter's AttributesIterator. The researchers demonstrated two end-to-end exploits: a cross-tenant secret theft via a URLPattern out-of-bounds read on the shared tcmalloc heap (bypassing V8 sandbox and MPK), and a Code Mode sandbox escape from prompt injection to native host RCE via the zlib UAF. All bugs operate on the tcmalloc native heap, which is explicitly outside the V8 sandbox cage and memory protection keys. Cloudflare's managed environment is patched; self-hosted deployments must update to workerd v1.20260619.1. No CVEs have been assigned.

2026-08-049 minElastic Security Labsmedium

Elastic Security Labs built an AI-powered vulnerability triage system for their HackerOne bug bounty program that uses Claude LLM in an eight-stage analysis pipeline with an independent adversarial review, achieving 85% agreement with human analysts at ~$2 per report. The system processes untrusted, attacker-controlled input at every stage, making prompt injection, credential exfiltration, and sandbox escape the primary threats to the triage infrastructure itself. A layered defense-in-depth architecture — ephemeral VMs, network isolation, egress filtering, credential separation, resource limits, and human-in-the-loop final decisions — mitigates these risks while keeping the cost per triage low.

2026-07-146 minCanadian Centre for Cyber Securitycritical

The Canadian Centre for Cyber Security published 6 security advisories on 2026-07-14 covering vulnerabilities in Siemens ICS products, SAP enterprise software, HPE servers, Mozilla Firefox, ServiceNow AI Platform, and Veeam Software Appliance. The most notable is CVE-2026-6875, a critical sandbox escape in the ServiceNow AI Platform. Mozilla Firefox and Veeam also received critical updates. Defenders should prioritize patching ServiceNow, Firefox, and Veeam immediately, while reviewing Siemens and SAP advisories for ICS and enterprise environment coverage.

2026-06-015 minTrend Microcritical

At Pwn2Own Berlin 2026, security researchers demonstrated 47 unique zero-day vulnerabilities across AI platforms and traditional enterprise software. Notable exploits included root-level code execution in AI agents via trust boundary failures, a SYSTEM-level RCE in Microsoft Exchange, a pre-authentication RCE in SharePoint, and a cross-tenant guest-to-host escape in VMware ESXi.

2026-05-134 minSocketcritical

A critical sandbox escape vulnerability (CVE-2026-26956) in the vm2 Node.js library allows attackers to execute arbitrary OS commands by leveraging WebAssembly.JSTag via VM.run(). The flaw affects versions 0.2.2 through 3.10.4 on Node.js runtimes exposing this tag, prompting the release of vm2 3.10.5 and a free Certified Patch from Socket to remove the tag from the sandbox environment.

2026-05-135 minPalo Alto Networkshigh

Unit 42 researchers discovered a method to bypass the network isolation of Amazon Bedrock AgentCore's Code Interpreter sandbox using DNS tunneling. Combined with a legacy MMDSv1 configuration that lacked session token enforcement, attackers could potentially exploit SSRF to extract highly privileged IAM credentials and exfiltrate them via the DNS covert channel.