Truffle Security launches program to revoke 1.4 million live secrets
Program helps API key issuers revoke 1.4 million exposed secrets using TruffleHog verification and webhooks.
2
Stories per day · 30 days
6 RSS
Relatedcve-2026-999994linux4open-source4vm-escape4kernel3developer-tools2firecracker2kvm2next.js2pwnescape2rce2sharp2accessibility1agent-desktop1ai-gateway1api-keys1cloud1code-scanning1
25 stories, newest first · one card per story
Stories tagged #vercel
Vercel rolls out protection against stolen session cookie attacks
Vercel binds logins to device TPM to prevent stolen cookie reuse
1
Vercel Labs open-sources agent-desktop for agent computer use
Version 1.0.2 under Apache-2.0 drives native apps on macOS, Windows and Linux without screenshots or a bundled model.
Vercel open-sources durable-harness for coding agents
The captured page is only a cookie banner, so how durable-harness works is not stated.
1
PwnEscape: Guest-to-Host KVM Escape (CVE-2026-99999)
Researchers show CVE-2026-99999 lets a KVM guest escape to the host via Linux checksum handling.
Jev is Vercel’s fastest-adopted AI model ever
Vercel says Typesafe AI’s Jev reached 35% of paid teams in two weeks, its fastest model adoption.
Linux kernel gets a fix for a flaw that enabled attackers to escape VMs
Linux patched CVE-2026-99999, a networking flaw researchers used to escape VMs to the host.
13
Critical Linux Kernel Flaw Lets Attackers Escape Virtual Machines and Take Control of Hosts
Linux kernel flaw CVE-2026-99999 can let a guest VM leak host memory and, in a lab, run code on the host.
Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory
Linux kernel flaw CVE-2026-99999 lets guest VMs read host memory, shown on Vercel sandboxes but not exploited in the wild.
Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js 16.4.1 and 15.5.28 patch two critical unauthenticated RCE bugs and a Server Actions denial of service.
Critical Next.js SVG Image Processing Vulnerability Could Enable Remote Code Execution
Vercel patched unauthenticated Next.js remote code execution in SVG image optimization, with no active exploitation reported.
OAuth grants pile up faster than you can review them. Here's how to keep up.
Nudge Security markets an agent that inventories and scores risky SaaS OAuth grants teams cannot review manually.
Security researcher claims they found KVM guest-host escape flaw
Paulos Yibelo claims a KVM guest-to-host root escape zero-day found via Vercel’s Firecracker sandbox bounty.
13
Vercel Confirms KVM Zero-Day VM Escape, Awards Researcher $50,000
Vercel confirmed researcher Paulos Yibelo's KVM zero-day guest-to-host root escape and paid a $50,000 bounty.
I got targeted: Trying to get your credentials via a git post-checkout hook
A fake client shared a Dropbox git repo whose post-checkout hook fetched and executed a remote binary.
1
Next.js ImageResponse Vulnerability Lets Remote Attackers Execute Code Through SVG Content
Unauthenticated attackers can execute code on Next.js 16.2.0–16.3.5 servers via crafted SVG in ImageResponse.
Threat Actors Use Google Ads To Target Ledger Users
Attackers used malicious Google ads to phish Ledger users for cryptocurrency recovery phrases.
1
Critical Next.js ImageResponse Flaw Can Lead to Server Code Execution via Crafted SVG Input
Vercel patched critical Next.js ImageResponse flaw CVE-2026-94545 (CVSS 9.5) allowing server code execution via crafted SVG input; no attacks reported yet.
The modern attack chain: Rethinking Google Workspace security in the age of AI
Analysis of Vercel and Composio breaches shows stolen OAuth tokens, not phishing email, now open Google Workspace attacks — a path authorized AI agents follow.
2
$1 Million Sandbox Challenge Uncovers Linux Kernel Flaws
Vercel's $1M sandbox challenge surfaced two Linux kernel networking defects—one leaking host kernel memory, one crashing hosts—with CVEs pending.
5
OpenAI's new Agents API gives developers the infrastructure behind Codex and ChatGPT
OpenAI released its Agents API in public beta, exposing the infrastructure behind Codex and ChatGPT for building long-running cloud agents.
US Becomes Top Target in RMM Phishing Campaign Spanning 46 Countries
ANY.RUN linked 601 RMM-tool phishing cases across 46 countries, with the US the top target at 45% of observed activity.
1
PRs NOT Welcome: How Top AI Open Source Projects Are Managing Thousands of Contributors
Top AI open source projects like Vercel, Astro, Flue, and tldraw are restricting external PRs and using agent-based software factories to triage, fix, and review contributions.
Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE
Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).