Google paid a record $250,000 for a Linux guest-VM escape.

Ars Technica reports it's one of two Linux flaws this week granting root to untrusted users. Guest escape breaks the isolation assumption underneath every multi-tenant inference host and every sandboxed agent runtime. If you run untrusted agent-generated code in VM isolation, this is a patching priority, not kernel-team trivia. Separately, Microsoft's patch for a Windows Defender 0-day still lets attackers exhaust disk space, which is a fine reminder that a shipped patch and a closed vulnerability class are different things.