Vercel April 2026 security incident

Post by steve1977 » Mon, Apr 20, 2026, 9:27 AM UTC

tgv wrote: post #447

steve1977 wrote: post #385

Earlier quoted context omitted.

I'm not super savvy with OAuth, but shouldn't scopes prevent issues like this? https://oauth.net/2/scope/

From what I understood at [1], Context.ai users "enable AI agents to perform actions across their external applications, facilitated via another 3rd-party service." I.e., it's designed to get someone's OAuth token and use it. Unless that is done really carefully, the risks are as high as the user's authorization goes. The danger doesn't only come from leaks, but also from agents, that can clear your db or directory a…

Post by owebmaster » Mon, Apr 20, 2026, 9:34 AM UTC

yogigan wrote: post #378

[flagged]

Post by cogogo » Mon, Apr 20, 2026, 9:43 AM UTC

anal_reactor wrote: post #440

nnurmanov wrote: post #353

Earlier quoted context omitted.

You have no idea how indifferent security officers can be-even when you point out critical issues. The other day, we flagged that a customer’s database had users with excessive privileges. Their only question: “Can this be exploited from the outside?” No, but most breaches today come from compromised internal accounts that are then used to break everything.

The problem with security is that often it's cheaper to deal with the bad outcome than to prevent it. Actually getting security right is very expensive because it requires virtually every engineer to have some security awareness, and engineers who can be trusted with that tend to be difficult to find. Meanwhile if you have a security incident you say "sorry", maybe you pay a small fine, and a month later everyone had…

Post by LtWorf » Mon, Apr 20, 2026, 9:47 AM UTC

sbrother wrote: post #135

embedding-shape wrote: post #51

Earlier quoted context omitted.

Huh, curiously; I'm on Arch Linux, crash happens in Google Chrome (147.0.7727.101) for me too, but not in Firefox (149.0.2) nor even in Chromium (147.0.7727.101). I find it fun we're all reading a story how Vercel likely is compromised somehow, and managed to reproduce a crash on their webpage, so now we all give it a try. Surely could never backfire :)

Following since I just reproduced the crash on my own system (Chrome on Ubuntu)

Post by deaux » Mon, Apr 20, 2026, 10:55 AM UTC

gitgud wrote: post #303

deaux wrote: post #105

Earlier quoted context omitted.

They put a massive amount of VC cash into convincing people that Next.js was "the modern way" to create a website. Then they got lucky with the timing of LLMs becoming popular while they were the hot thing, leading LLMs to default to it when creating new websites. To picture that amount of VC cash - they're at Series F , and a huge chunk of that went towards marketing. Both have been changing as people realize it's r…

I don’t think they “got lucky”. nextjs is an old project now, and for a long time it was the simplest framework to run a React website. This is why most open source landing pages used nextjs, and if most FOSS landing pages use it, then most LLM’s have been trained on it, which means LLM’s are more familiar with that framework and choose it There must be a term for this kind of LLM driven adoption flywheel…