A Linux SVM hypervisor for emulating cpuid and sgdt/sidt results per-process by simply loading a Linux kernel module.
After loading, the module exposes a misc device at /dev/alcor_ctrl, which allows every process to change the cpuid and descriptor view of itself or, with CAP_SYS_PTRACE, any other process. See Usage for the exposed API.

A crafted PostScript program defeats the -dSAFER sandbox and runs an attacker-chosen shell command when Ghostscript renders it. The exploit chains a Type 5 shading out-of-bounds heap write with a procedure-stream use-after-free information leak. The leak defeats ASLR and locates Ghostscript's SAFER path-control state in memory; the write flips that state to inactive; then the program opens a %pipe% stream to run the command.

A Twitch chat overlay exploited a vulnerable Chromium renderer and V8 bug to execute native code on a streamer's machine, bypassing the browser sandbox. The vulnerability was patched in Chrome 128, but an OBS update is underway to upgrade the embedded browser and enable the sandbox.