Virtual Escape; Real Reward: Introducing Google’s kvmCTF

Google announced kvmCTF, a vulnerability reward program for zero-day flaws in the KVM hypervisor, offering a controlled lab where participants attempt guest-to-host exploits to capture flags. Rewards range from $10,000 to $250,000 based on impact (including relative/absolute memory read/write, DoS, and full VM escape), with optional KASAN-enabled hosts to validate certain tiers. Participants reserve time slots, follow program rules for access and reporting, and disclose zero-days to Google only after upstream patches are released.