Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

191–200 of 540 posts

Re: Vercel April 2026 security incident

#191

Post by tom1337 »

MattIPv4 wrote: post #4

Related: https://news.ycombinator.com/item?id=47824426 https://x.com/theo/status/2045862972342313374 > I have reason to believe this is credible. https://x.com/theo/status/2045870216555499636 > Env vars marked as sensitive are safe. Ones NOT marked as sensitive should be rolled out of precaution https://x.com/theo/status/2045871215705747965 > Everything I know about this hack suggests it could happen to any host http…

> Ones NOT marked as sensitive should be rolled out of precaution

if it's not marked as sensitive (because it is not sensitive) there is no reason to roll them. if you must roll a insensitive env var it should've been sensitive in the first place, no?

Re: Vercel April 2026 security incident

#192

Post by seattle_spring »

gbgarbeb wrote: post #148
operatingthetan wrote: post #125

Earlier quoted context omitted.

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

10 years ago it was Heroku and Three.js.

10 years ago it was Heroku and Ruby on Rails*

Re: Vercel April 2026 security incident

#193

Post by loloquwowndueo »

nettlin wrote: post #180

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

The actual app name would be good to have. Understandable they don’t want to throw them under the bus but it’s just delaying taking action by not revealing what app/service this was.

Re: Vercel April 2026 security incident

#194

Post by Something1234 »

egeozcan wrote: post #159
andersmurphy wrote: post #130

Earlier quoted context omitted.

That's the irony of Mythos. It doesn't need to exist. LLM vibe slop has already eroded the security of your average site.

Self fulfilling prophecy: You don't need to secure anything because it doesn't make a difference, as Mythos is not just a delicious Greek beer, but also a super-intelligent system that will penetrate any of your cyber-defenses anyway.

Explain more about this beer.

Re: Vercel April 2026 security incident

#195

Post by duped »

dennisy wrote: post #183
duped wrote: post #178

Earlier quoted context omitted.

No, the problem is the people building and selling these tools. They are marketed as a way of outsourcing thinking.

So what are you suggesting do not allow companies to sell such tools?

I'm suggesting people shouldn't lie to sell things because their customers will believe them and this causes measurable harm to society.

Re: Vercel April 2026 security incident

#196

Post by Aurornis »

otterley wrote: post #31
MattIPv4 wrote: post #4

Related: https://news.ycombinator.com/item?id=47824426 https://x.com/theo/status/2045862972342313374 > I have reason to believe this is credible. https://x.com/theo/status/2045870216555499636 > Env vars marked as sensitive are safe. Ones NOT marked as sensitive should be rolled out of precaution https://x.com/theo/status/2045871215705747965 > Everything I know about this hack suggests it could happen to any host http…

Who is this “theo” person and why are multiple people quoting him? He seems to have little to say that’s substantive at this point.

He’s a streamer who talks about tech. Previously had a sponsorship relationship with Vercel so is theoretically more well connected than average on the topic. He’s also very divisive because he does a lot of ragebait, grievance reporting, and contrarian takes but famously has blind spots for a few companies and technologies that he’s favored in past videos or been sponsored by. I have friends who watch a lot of his videos but I’ve never been able to get into it.

Re: Vercel April 2026 security incident

#197

Post by rpcope1 »

alex7o wrote: post #167
operatingthetan wrote: post #146

Earlier quoted context omitted.

I guess engineers can differentiate their vibecoded projects by selecting an eccentric stack.

Choosing an eccentric stack makes the llms do better even. Like Effect.ts or Elixir

I actually noticed the same. Having it work on Mithril.js instead of React seems (I know it's all just kind of hearsay) to generate a lot cleaner code. Maybe it's just because I know and like Mithril better, but also is likely because of the project ethos and it's being used by people who really want to use Mithril in the wild. I've seen the same for other slightly more exotic stacks like bottle vs flask, and telling it to generate Scala or Erlang.

Re: Vercel April 2026 security incident

#198

Post by BigTTYGothGF »

neilv wrote: post #175
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

> forcing myself to use Claude Code

You don't have to live like this.

Post reply on HN