
Firecracker-specific surface: CVE-2026-1386: Jailer symlink → arbitrary host file overwrite CVE-2019-18960: virtio-vsock → r/w in VMM process io_uring: still in seccomp allowlist, bypasses filtering The Jailer IS the last defense. If it falls, nothing's left.
Post summary
The snippet enumerates two Firecracker CVEs with technical impact details, but provides no proof of concept, exploit code, patch, or evidence of active exploitation.

