Vercel April 2026 security incident

Post by Neikius » Mon, Apr 20, 2026, 6:24 AM UTC

lofaszvanitt wrote: post #387

Vates wrote: post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

The whole hiring system needs to be eradicated. You get grilled by incompetents, who ask one question, never ask back when you provide something that is debatable, they give zero feedback and then you see what kind of errors these "elitist" engineers make. Burn it to the ground.

Post by _pdp_ » Mon, Apr 20, 2026, 6:27 AM UTC

ryanscio wrote: post #295

nettlin wrote: post #180

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

https://x.com/rauchg/status/2045995362499076169 > A Vercel employee got compromised via the breach of an AI platform customer called http://Context.ai that he was using. > Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments. > We do have a capability however to designate environment variables as “non-sens…

Post by Maxious » Mon, Apr 20, 2026, 6:37 AM UTC

eddythompson80 wrote: post #415

Am I reading this[1] correctly that they basically had that "compromised OAuth token" for a month now and it was only detected now when the attackers posted about it in a forum? [1] https://context.ai/security-update

Post by codeulike » Mon, Apr 20, 2026, 6:38 AM UTC

gitgud wrote: post #303

deaux wrote: post #105

Earlier quoted context omitted.

They put a massive amount of VC cash into convincing people that Next.js was "the modern way" to create a website. Then they got lucky with the timing of LLMs becoming popular while they were the hot thing, leading LLMs to default to it when creating new websites. To picture that amount of VC cash - they're at Series F , and a huge chunk of that went towards marketing. Both have been changing as people realize it's r…

I don’t think they “got lucky”. nextjs is an old project now, and for a long time it was the simplest framework to run a React website. This is why most open source landing pages used nextjs, and if most FOSS landing pages use it, then most LLM’s have been trained on it, which means LLM’s are more familiar with that framework and choose it There must be a term for this kind of LLM driven adoption flywheel…

Post by scott_w » Mon, Apr 20, 2026, 6:45 AM UTC

steve1977 wrote: post #406

hvb2 wrote: post #402

Earlier quoted context omitted.

Sure, and the reason he is is because he DOES check stuff like this before sending it out. Top leaders excel because they assemble a team around them they trust. You can't do everything yourself, you need to delegate. And having people in those positions also means you shouldn't be acting alone or those people will not stick around

I disagree. In a crisis, a leader should take the lead and make decisions. If he/she is not able to that on their own, they are in the wrong place. Now I will agree that there are many executives like the ones you describe. But they are not top leaders.