vercel

Vercel's CEO Guillermo Rauch tweeted that the team has completed an in-depth security investigation, analyzing nearly 1 PB of complete Vercel network and API logs, far exceeding the initial Context.ai account breach incident.The investigation revealed that the attackers' activities extended beyond Context.ai and have distributed malware on a broader scale, targeting account keys from platforms like Vercel. Once the keys are obtained, the attackers quickly and comprehensively enumerate non-sensitive environment variables. Current measures include deepening collaboration with industry partners such as Microsoft, AWS, and Wiz to jointly protect the broader internet ecosystem; other suspected victims have been notified and advised to immediately rotate credentials and strengthen security best practices.

Vercel announced a security incident analysis, stating that some of its internal systems were accessed without authorization. This was caused by a third-party AI tool, Context.ai, used by an employee being compromised, allowing the attacker to take over their Google Workspace account and access some environment configuration data.The initial impact is that a small number of environment variables not marked as "sensitive" (such as API Keys, Tokens, etc.) may have been leaked. Relevant users have been notified and advised to rotate their credentials immediately. There is currently no evidence that data marked as "sensitive" or the supply chain (such as npm packages) has been tampered with.Vercel stated that the attacker possesses a high level of technical skill and has partnered with Mandiant and several security agencies to investigate, and has reported the incident to law enforcement. They also emphasized that platform services are still operating normally. Additionally, users are advised to enable multi-factor authentication, comprehensively rotate potentially leaked environment variables, and check account activity logs and deployment records to prevent further risks.

In response to the security incident and supply chain security risks of the front-end platform Vercel, the Binance security team has promptly initiated an emergency response, completed a comprehensive risk assessment of the front-end of products within the Binance system, and directly contacted Vercel to verify and confirm each issue.Binance stated that its platform and user assets are not affected by this incident.

In response to the recent security incident on the Vercel platform, Jupiter stated that it has not received any notifications or signs of being affected, and its jup.ag frontend does not store any sensitive information.Jupiter has proactively implemented all security measures recommended by Vercel, completed all key rotations, and conducted a comprehensive review of system logs, finding no suspicious activity. Continuous monitoring is currently in place.

The Solana ecosystem DeFi protocol Meteora announcement has noted the latest developments regarding the security incident of the cloud hosting platform Vercel. The environment keys were immediately rotated and logs were checked 12 hours ago, and everything is normal. The official team will continue to monitor the situation to ensure the safety of Meteora and its users.

Orca posted on the X platform that its frontend is hosted on the cloud hosting platform Vercel. In response to the Vercel security incident, all potentially leaked keys and deployment credentials have been rotated out of caution. Orca's on-chain protocol and user funds were not affected. The official team will continue to monitor the situation and will provide updates as more information becomes available.

The Chief Information Security Officer of Slow Fog Technology, 23pds, retweeted that the internal system of the cloud hosting platform Vercel was accessed without authorization, which is suspected to be related to an internal data breach.The related tweet indicated that someone on BreachForums claimed to be ShinyHunters and is selling the so-called Vercel internal database, access keys, source code, employee accounts, API keys, NPM tokens, and GitHub tokens for $2 million. The related data is suspected to involve Vercel's internal Linear system and internal user management system.Previously, the cloud hosting platform Vercel disclosed that its internal system was accessed without authorization, affecting a small number of customers.

According to official news, the cloud hosting platform Vercel has confirmed that a security incident has occurred, involving unauthorized access to some internal systems.Currently, only a small number of customers have been confirmed to be affected, and Vercel is communicating directly with the relevant customers. Vercel stated that its services are still operating normally, and it has initiated an investigation and hired incident response experts to assist in handling the situation, while also notifying law enforcement.Vercel recommends that all customers review their environment variables and use the sensitive environment variable feature to enhance security protection.

ChainCatcher news, August 27, according to official news, the AI front-end development tool v0 under the American cloud development platform company Vercel has announced that it now accepts users to purchase v0 credits using USDC.

ChainCatcher news, Paradigm and Wevm have collaborated to launch the Frog toolkit based on Farcaster Frames, allowing developers to build high-quality, high-performance, and lightweight frameworks with minimal code.In addition, Frog comes with a built-in debugger that supports live reloading, enabling developers to establish a tight feedback loop between the code and the framework interface. Frog is integrated on top of the small and fast JavaScript web framework Hono, allowing users to build frameworks using JSX and integrate them into any platform or runtime, such as Cloudflare, Vercel, Next.js, Bun, etc.