October 27, 2026
- Two critical Wasmtime sandbox escapes (CVSS 9.9). CVE-2026-115889 affects all architectures; CVE-2026-115893 is ARM64-only and has been present since 2020. Both sit in the Cranelift compiler, both require a module the attacker controls — so the risk concentrates on platforms that compile third-party WebAssembly (Fastly's Compute runs customer code on Wasmtime). Fixed October 19–20; no attacks reported, and the 24.x LTS line, support ended August 20, got no fix. Neither advisory lists a workaround (The Hacker News). · Vulnerabilities & Exploits