frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Vercel April 2026 security incident

https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
113•colesantiago•1h ago

Comments

OsrsNeedsf2P•1h ago
The lack of details makes me wonder how large this "subset" of users really is
MattIPv4•1h ago
Related: https://news.ycombinator.com/item?id=47824426

https://x.com/theo/status/2045862972342313374

> I have reason to believe this is credible.

https://x.com/theo/status/2045870216555499636

> Env vars marked as sensitive are safe. Ones NOT marked as sensitive should be rolled out of precaution

https://x.com/theo/status/2045871215705747965

> Everything I know about this hack suggests it could happen to any host

https://x.com/DiffeKey/status/2045813085408051670

> Vercel has reportedly been breached by ShinyHunters.

otterley•7m ago
Who is this “theo” person and why are multiple people quoting him? He seems to have little to say that’s substantive at this point.
ofabioroma•1h ago
Time to ipo
neom•59m ago
https://x.com/theo/status/2045871215705747965 - "Everything I know about this hack suggests it could happen to any host"

He also suggests in another post that Linear and GitHub could also be pwned?

Either way, hugops to all the SRE/DevOps out there, seems like it's going to be a busy Sunday for many.

rvz•48m ago
I do remember that OpenAI did use Vercel a year ago. They might have likely moved off of it to something better.
embedding-shape•47m ago
Based on what, "feels like it"? Claiming that Cloudflare is affected by the same hack has to come from somewhere, but where is that coming from?
gruez•42m ago
from his "sources".

> Here’s what I’ve managed to get from my sources:

>3. The method of compromise was likely used to hit multiple companies other than Vercel.

https://x.com/theo/status/2045870216555499636

To be fair journalists often do this too, eg. "[company] was breached, people within the company claim"

eddythompson80•36s ago
Isn’t he a Vercel evangelist though?
phillipcarter•20m ago
I don't know if I'd trust some random programmer-streamer-influencer on anything other than the topic of streamer-influencing.
hvb2•6m ago
The link at the top of the page it to vercel acknowledging it...
techpression•17m ago
”Any host” of what? That’s such a non-descriptive statement and clearly not true at face value.
recursivegirth•5m ago
Ah, Theo with his vast insights and connections into everything. That man gets around, and his content is worth it's cost.

Theo's content boils down to the same boring formula. 1. Whatever buzzword headline is trending at the time 2. Immediate sponsored ad that is supposed to make you sympathize with Theo cause he "vets" his sponsors. 3. The man makes you listen to a "that totally happened" story that he somehow always involved himself personally. 4. Man serves you up an ad for his t3.chat and how it's the greatest thing in the world and how he should be paid more for his infinite wisdom. 5. A rag on Claude or OpenAI (whichever is leading at the time) 6. 5-10 minutes of paraphrasing an article without critical thought or analysis on the video topic.

I used to enjoy his content when he was still in his Ping era, but it's clear hes drunken the YT marketer kool-aid. I've moved on, his content gets recommend now and again, but I can't entertain his non-sense anymore.

jtreminio•54m ago
I'm on a macbook pro, Google Chrome 147.0.7727.56.

Clicking the Vercel logo at the top left of the page hard crashes my Chrome app. Like, immediate crash.

What an interesting bug.

farnulfo•47m ago
Same hard crash on Chrome Windows 11
itaintmagic•39m ago
Do you have a chrome://crashes/ entry ?
burnte•6m ago
I'm running 147.0.7727.57 and this doesn't happen. Macbook Air M5. VERY interesting.
rvz•50m ago
There is no serious reason to use Vercel, other than for those being locked into the NextJs ecosystem and demo projects.
gneray•48m ago
Oy vey: https://x.com/theo/status/2045862972342313374?s=46
rubiquity•15m ago
He doesn't work at Vercel but he is the type to never pass up any opportunity to chase clout.
0xy•45m ago
This is why you pay a real provider for serious business needs, not an AWS reseller. Next.js is a fundamentally insecure framework, as server components are an anti-pattern full of magic leading to stuff like the below. Given their standards for framework security, it's not hard to believe their business' control plane is just as insecure (and probably built using the same insecure framework).

Next.js is the new PHP, but worse, since unlike PHP you don't really know what's server side and what's client side anymore. It's all just commingled and handled magically.

https://aws.amazon.com/security/security-bulletins/rss/aws-2...

embedding-shape•40m ago
> Next.js is the new PHP, but worse, since unlike PHP you don't really know what's server side and what's client side anymore. It's all just commingled and handled magically.

Wasn't unheard of back in the day, that you leaked things via PHP templates, like serializing and adding the whole user object including private details in a Twig template or whatever, it just happened the other way around kind of. This was before a fat frontend and thin backend was the prevalent architecture, many built their "frontends" from templates with just sprinkles of JavaScript back then.

sbarre•22m ago
People say "Next.js is the new PHP" because it's the most popular and prominent tooling out there, and so by sheer number of available targets it's the one that comes up the most when things go wrong like this.

But there are more people trying to secure this framework and the underlying tools than there would be on some obscure framework or something the average company built themselves.

Also "pay a real provider", what does that mean? Are you again implying that the average company should be responsible for _more_ of their own security in their hosting stack, not less?

Most companies have _zero_ security engineers.. Using a vertically-integrated hosting company like Vercel (or other similar companies, perhaps with different tech stacks - this opinion has nothing to do with Next or Node) is very likely their best and most secure option based on what they are able to invest in that area.

mikert89•38m ago
Much as I want to rip on vercel, its clear that ai is going to lead to mass security breaches. The attack surface is so large, and ai agents are working around the clock. This is a new normal. Open source software is going to change, companies wont be running random repos off github anymore
lijok•36m ago
ShinyHunters are a phishing group. What does this have to do with AI agents?
mikert89•33m ago
Run ai agents around the clock to do hyper targeted fishing
cj•22m ago
I feel like humans would be better at hyper targeting.

AI agents have the benefit of working at scale, probably "better" used for mass targeting.

freedomben•13m ago
I disagree. Many humans are phishing in a different language than their native tongue, and LLMs are way better at sounding legit/professional than many of them. The best spear-phishing will still be humans, but AI definitely raises the bar.
mikert89•4m ago
this like is saying email marketing is done better if you hand write every email. Thats true, but the hit rate is so low, that you are better off generating 1 million hyper personalized emails and firing them off into the ether
tcp_handshaker•10m ago
>> ai is going to lead to mass security breaches.

Let that be the end of Microsoft. Was forced to use their shitty products for years, by corporate inertia and their free Teams and Azure licenses, first-dose-is-free, curse.

sph•3m ago
Your entire recent posting history is "software engineering is over."

What's your agenda here?

adithyasrin•11m ago
We run on Vercel and I wonder if / how long before we're alerted about a leak. Quick look online suggests environment variables marked as sensitive are ok, but to which extent I wonder.

Archive of Byte magazine, starting with issue #1 in 1975

https://archive.org/details/byte-magazine-1975-09
314•DamnInteresting•2d ago•80 comments

Vercel Says Internal Systems Hit in Breach

https://decipher.sc/2026/04/19/vercel-says-internal-systems-hit-in-breach/
51•whiteyford•32m ago•2 comments

Notes from the SF Peptide Scene

https://12gramsofcarbon.com/p/notes-from-the-sf-peptide-scene
23•theahura•1h ago•12 comments

Nanopass Framework: Clean Compiler Creation Language

https://nanopass.org/
46•NordStreamYacht•4d ago•3 comments

SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit [pdf] (2017)

https://www.usenix.org/system/files/conference/woot17/woot17-paper-guri.pdf
113•Eridanus2•7h ago•53 comments

The seven programming ur-languages (2022)

https://madhadron.com/programming/seven_ur_languages.html
132•helloplanets•8h ago•48 comments

Show HN: Shader Lab, like Photoshop but for shaders

https://eng.basement.studio/tools/shader-lab
66•ragojose•2d ago•10 comments

Game devs explain the tricks involved with letting you pause a game

https://kotaku.com/video-game-devs-explain-how-pausing-works-and-sometimes-it-gets-weird-2000686339
276•speckx•3d ago•164 comments

Vercel April 2026 security incident

https://vercel.com/kb/bulletin/vercel-april-2026-security-incident
114•colesantiago•1h ago•33 comments

The creative software industry has declared war on Adobe

https://www.theverge.com/tech/913765/adobe-rivals-free-creative-software-app-updates
53•tambourine_man•1h ago•25 comments

Pairwise Order of a Sequence of Elements

https://morwenn.github.io//presortedness/2026/04/11/TSB010-pairwise-order-of-a-sequence-of-elemen...
6•ibobev•2d ago•0 comments

What are skiplists good for?

https://antithesis.com/blog/2026/skiptrees/
179•mfiguiere•2d ago•37 comments

NIST scientists create 'any wavelength' lasers

https://www.nist.gov/news-events/news/2026/04/any-color-you-nist-scientists-create-any-wavelength...
372•rbanffy•19h ago•159 comments

College instructor turns to typewriters to curb AI-written work

https://sentinelcolorado.com/uncategorized/a-college-instructor-turns-to-typewriters-to-curb-ai-w...
370•gnabgib•20h ago•349 comments

When moving fast, talking is the first thing to break

https://daverupert.com/2026/04/more-talk-less-grok/
27•Brajeshwar•1h ago•14 comments

Airline worker arrested after sharing photos of bomb damage in WhatsApp group

https://www.lbc.co.uk/article/dubai-police-spied-private-whatsapp-5HjdXwr_2/
124•aa_is_op•2h ago•85 comments

Anonymous request-token comparisons from Opus 4.6 and Opus 4.7

https://tokens.billchambers.me/leaderboard
574•anabranch•23h ago•546 comments

Ask HN: How did you land your first projects as a solo engineer/consultant?

134•modelcroissant•6h ago•63 comments

The electromechanical angle computer inside the B-52 bomber's star tracker

https://www.righto.com/2026/04/B-52-star-tracker-angle-computer.html
379•NelsonMinar•23h ago•97 comments

Binary GCD

https://en.algorithmica.org/hpc/algorithms/gcd/#binary-gcd
36•tosh•7h ago•1 comments

Minimal Viable Programs (2014)

https://joearms.github.io/published/2014-06-25-minimal-viable-program.html
14•bachmeier•3d ago•3 comments

Show HN: Prompt-to-Excalidraw demo with Gemma 4 E2B in the browser (3.1GB)

https://teamchong.github.io/turboquant-wasm/draw.html
24•teamchong•4h ago•15 comments

Why Japan has such good railways

https://worksinprogress.co/issue/why-japan-has-such-good-railways/
475•RickJWagner•1d ago•446 comments

Matt Mullenweg Overrules Core Committers; Puts Akismet on WP 7's Connector List

https://www.therepository.email/matt-mullenweg-overrules-core-committers-to-put-akismet-on-wordpr...
18•mooreds•1h ago•14 comments

It's cool to care (2025)

https://alexwlchan.net/2025/cool-to-care/
59•surprisetalk•4d ago•29 comments

The world in which IPv6 was a good design (2017)

https://apenwarr.ca/log/20170810
138•signa11•13h ago•41 comments

Updating Gun Rocket through 10 years of Unity Engine

https://jackpritz.com/blog/updating-gun-rocket-through-10-years-of-unity-engine
101•tyleo•3d ago•48 comments

State of Kdenlive

https://kdenlive.org/news/2026/state-2026/
434•f_r_d•1d ago•132 comments

Turtle WoW classic server announces shutdown after Blizzard wins injunction

https://www.pcgamer.com/games/world-of-warcraft/turtle-wow-classic-server-announces-shutdown-afte...
3•Brajeshwar•7m ago•0 comments

Binary Dependencies: Identifying the Hidden Packages We All Depend On

https://vlad.website/binary-dependencies-identifying-the-hidden-packages-we-all-depend-on/
47•PaulHoule•2d ago•8 comments