On FreeBSD hypervisor hosts: freebsd-update fetch install (or pkg upgrade -r FreeBSD-base on base-package installs) to 14.4-p11 / 14.5-p2 / 15.1-p5 or newer STABLE, then restart every bhyve VM—or reboot the host. If you cannot patch tonight, drop xhci, hda, and fbuf from guest device configs (VMs without those three are out of scope per the advisory). Remember Capsicum still bounds the host userspace process; treat a successful guest escape as a full host-userspace compromise inside that sandbox and rotate any secrets the bhyve process could read.