12 article(s) in our index mention this organisation.
Researchers at Imperva demonstrated a Remote Code Execution (RCE) vulnerability, CVE-2026-111497, in Node.js applications due to crafted Brotli data. Vercel added rules to block the attack in inbound requests, but this d…
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js bundles, which the proj…
A critical vulnerability, CVE-2026-99999, in the Linux kernel allows code running inside a virtual machine to read memory on the host computer. While no real-world attacks have been reported, the vulnerability poses a ri…
Researchers at AIR discovered a vulnerability in Vercel Sandbox, an AI development sandbox, that allows rogue AI agents to bypass network restrictions and leak sensitive data by exploiting certificate validation processe…
A security researcher, Paulos Yibelo, discovered a ‘Full VM escape zeroday’ in Linux KVM, the hypervisor used by companies like Vercel and AWS. The Vercel Sandbox program, utilizing AWS’s Firecracker MicroVMs based on KV…
A critical vulnerability in Next.js's ImageResponse feature, tracked as CVE-2026-94545, allows attackers to execute code on a server by injecting attacker-controlled values into SVG content. Vercel has released version 1…
Vercel’s two-week bug bounty program, utilizing a $1 million reward, uncovered two critical vulnerabilities within the Linux kernel’s networking stack. Despite receiving 1,285 reports, no attackers were able to access cu…
A critical vulnerability in JFrog Artifactory, patched just days after its disclosure, is being actively exploited by threat actors to gain administrative access. This allows attackers to poison build pipelines and escal…
Next.js has released security patches to address two critical vulnerabilities. The first, a Windows path traversal flaw, allows unauthenticated remote code execution when processing specially crafted AVIF images. The sec…
Security flaws have been discovered in agent infrastructure used by AWS, Google, and Vercel, allowing attackers to bypass model checks and directly invoke tools without a legitimate model turn. These vulnerabilities stem…
Threat actors are increasingly leveraging legitimate cloud platforms – like Cloudflare, Vercel, Netlify, and GitHub Pages – to conduct sophisticated phishing attacks. These attacks utilize multi-stage adversary-in-the-mi…
This BleepingComputer article highlights the increasing threat of supply-chain attacks, which target the tools and vendors organizations rely on. The article details how early warning signs of these attacks often appear…
