Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

451–460 of 540 posts

Re: Vercel April 2026 security incident

#451

Post by aquariusDue »

cyral wrote: post #342
Aurornis wrote: post #189

Earlier quoted context omitted.

Reddit vibecoded LLM posts are kind of fascinating for how homogenous they are. The number of vibe coded half-finished projects posted to common subreddits daily is crazy high. It’s interesting how they all use LLMs to write their Reddit posts, too. Some of them could have drawn in some people if they took 5 minutes to type an announcement post in their own words, but they all have the same LLM style announcement pos…

It's insane how most of the dev subreddits are filled with slop like this. I've thought the same thing - why can't they even spend 5 minutes to write their own post about their project?

Yeah, in the last 6 to 10 months /r/rust has become littered with this stuff. There's still some good discussion going on but now I have to sort through garbage. The signal to noise ratio is out of whack these days that I generally avoid platforms like Substack, Medium and so on too.

Re: Vercel April 2026 security incident

#452

Post by igleria »

neya wrote: post #398
Vates wrote: post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

Polite reminder as to why Domain Driven Design is super-important. It makes more sense to spend 80% on DDD initially and then only 20% on the code (80-20 rule) vs the other way round. Or you will end up in a clusterfuck like this.

Domain Driven Design is something that I have only come to know with full understanding at my current job and oh my it is useful. It's not a silver bullet, but for complex domains it's a must.

Re: Vercel April 2026 security incident

#453

Post by vicchenai »

Vates wrote: post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

three critical vulns in 12 months is a pattern not a coincidence. the SRP point is sharp - we interview engineers on isolation principles then build platforms that are the opposite of that.

Re: Vercel April 2026 security incident

#454

Post by ptx »

ryanscio wrote: post #295
nettlin wrote: post #180

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

https://x.com/rauchg/status/2045995362499076169 > A Vercel employee got compromised via the breach of an AI platform customer called http://Context.ai that he was using. > Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments. > We do have a capability however to designate environment variables as “non-sens…

> an AI platform customer called http://Context.ai that he was using

Hmm? Who is the customer in this relationship? Is Vercel using a service provided by Context.ai which is hosted on Vercel?

Re: Vercel April 2026 security incident

#455

Post by zrn900 »

0xy wrote: post #14

This is why you pay a real provider for serious business needs, not an AWS reseller. Next.js is a fundamentally insecure framework, as server components are an anti-pattern full of magic leading to stuff like the below. Given their standards for framework security, it's not hard to believe their business' control plane is just as insecure (and probably built using the same insecure framework). Next.js is the new PHP,…

The new PHP? PHP is the same PHP and it's still running 80% of the web to the point that even Reuters, NASA, White House are on it.

Re: Vercel April 2026 security incident

#457

Post by eddythompson80 »

otterley wrote: post #369
eddythompson80 wrote: post #347

Earlier quoted context omitted.

> It’s about as insecure as having one Apache Server serving multiple customer’s accounts. You really have no clue what you’re talking about don’t you? Were you a sales guy at AWS or something?

Hey, knock it off. If you disagree with someone, present a substantive counterargument.

Already did. There is no fixing a pretender. Someone arguing akin to “the security boundary of a Linux system is the electrical strip”

Re: Vercel April 2026 security incident

#458

Post by scott_w »

scott_w wrote: post #448
steve1977 wrote: post #427

Earlier quoted context omitted.

First of all, I would expect a top leader to be prepared for scenarios like this (including templates of customer communication). And yeah, I would expect a CEO to have enough legal knowledge to handle such a situation (customer communication) on his own. But I also have to mentioned that I'm not in the US. Not every country has the litigation system of the US where you can basically destroy a company because you as…

You expect the CEO of a company to have the legal depth of knowledge AND knowledge of all their customers, contracts and SLAs to be able to wing a communication and not somehow trip over all of that? They also should understand every possible legal jurisdiction that could be affected? You realise even the head of their legal department (a HIGHLY competent lawyer) likely wouldn’t say there could do that without speaki…

Let me be more clear on what I mean by “wing it,” because “having templates” doesn’t really cut it. Anyone can bang out a “we have a problem” template, so why does the CEO need to attach their name to it? Once you’re at the point of needing a CEO to communicate, you have a specific problem, with its own specific impacts that a single person can not be expected to have enough depth of knowledge in their brain to actually talk about without involving their domain experts, including legal, technical, whatever the situation needs.

Re: Vercel April 2026 security incident

#459

Post by thaumasiotes »

derefr wrote: post #312
Aurornis wrote: post #189

Earlier quoted context omitted.

Reddit vibecoded LLM posts are kind of fascinating for how homogenous they are. The number of vibe coded half-finished projects posted to common subreddits daily is crazy high. It’s interesting how they all use LLMs to write their Reddit posts, too. Some of them could have drawn in some people if they took 5 minutes to type an announcement post in their own words, but they all have the same LLM style announcement pos…

I find that often the developers of these apps don't speak English, but want to target an English-speaking audience. For the marketing copy, they're using the LLM more to translate than to paraphrase, but the LLM ends up paraphrasing anyway.

> For the marketing copy, they're using the LLM more to translate than to paraphrase, but the LLM ends up paraphrasing anyway.

What do you see as the distinction between "translating" and "paraphrasing"? All translations are necessarily paraphrased.

Re: Vercel April 2026 security incident

#460

Post by kyle787 »

Context AI published a statement https://context.ai/security-update

> Last month, we identified and stopped a security incident involving unauthorized access to our AWS environment.

> Today, based on information provided by Vercel and some additional internal investigation, we learned that, during the incident last month, the unauthorized actor also likely compromised OAuth tokens for some of our consumer users.

Post reply on HN