Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

351–360 of 540 posts

Re: Vercel April 2026 security incident

#351

Post by nnurmanov »

cowsup wrote: post #304
ryanscio wrote: post #295

Earlier quoted context omitted.

https://x.com/rauchg/status/2045995362499076169 > A Vercel employee got compromised via the breach of an AI platform customer called http://Context.ai that he was using. > Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments. > We do have a capability however to designate environment variables as “non-sens…

> Still no email blast from Vercel alerting users, which is concerning. On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams. But on the other hand... It's Sunday. Unless you're tuned-in to social media over the weekend, your main provider could be undergoing a meltdown while you are completely unaware. Many higher-up folks check company…

Usually, companies have procedures for such events. But most do not.

Re: Vercel April 2026 security incident

#352

Post by gnabgib »

nnurmanov wrote: post #351
cowsup wrote: post #304

Earlier quoted context omitted.

> Still no email blast from Vercel alerting users, which is concerning. On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams. But on the other hand... It's Sunday. Unless you're tuned-in to social media over the weekend, your main provider could be undergoing a meltdown while you are completely unaware. Many higher-up folks check company…

Usually, companies have procedures for such events. But most do not.

Usually have procedures, but most don't? Say again

Re: Vercel April 2026 security incident

#353

Post by nnurmanov »

Vates wrote: post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

You have no idea how indifferent security officers can be-even when you point out critical issues. The other day, we flagged that a customer’s database had users with excessive privileges. Their only question: “Can this be exploited from the outside?”

No, but most breaches today come from compromised internal accounts that are then used to break everything.

Re: Vercel April 2026 security incident

#354

Post by egeozcan »

Something1234 wrote: post #194
egeozcan wrote: post #159

Earlier quoted context omitted.

Self fulfilling prophecy: You don't need to secure anything because it doesn't make a difference, as Mythos is not just a delicious Greek beer, but also a super-intelligent system that will penetrate any of your cyber-defenses anyway.

Explain more about this beer.

https://en.wikipedia.org/wiki/Mythos_Beer

I really like it. Recommended.

Re: Vercel April 2026 security incident

#356

Post by cleaning »

0xmattf wrote: post #292
cleaning wrote: post #279

Earlier quoted context omitted.

If you're only paying $3-5 on Linode then your level of usage would probably be comfortably at $0 on Vercel.

It could be $0 on Render too, but then there's going to be a 3 minute load time for a landing page to become visible, lol. So if you don't want your server to sleep, you're going to have to pay $20/month. Does Vercel do the same?

No.

Re: Vercel April 2026 security incident

#358

Post by [deleted] »

pianopatrick wrote: post #341
lijok wrote: post #221

Earlier quoted context omitted.

This isn't a web development concept. It's the unix philosophy of "write programs that do one thing and do it well" and interconnect them, being taken to the extremes that were never intended. We need a different hosting model.

Just throwing it out there - the Unix way to write software is often revered. But ideas about how to write software that came from the 1970s at Bell Labs might not be the best ideas for writing software for the modern web. Instead of "programs that do one thing and do it well", "write programs which are designed to be used together" and "write programs to handle text streams", I might go with a foundational philosoph…

[deleted]
Post reply on HN