The Vercel security and compute teams have conducted an investigation into the malicious takeover of the 𝚊𝚡𝚒𝚘𝚜@𝟷.𝟷𝟺.𝟷 npm package.
• We’ve blocked outgoing access from our build infrastructure to the Command & Control hostname 𝚜𝚏𝚛𝚌𝚕𝚊𝚔.𝚌𝚘𝚖.
• The malicious version of the package has been blocked and unpublished from npm.
• Vercel’s own infrastructure and applications have been unaffected.
• We recommend checking your supply chain for exposure.
For more information, read the full advisory ↓
https://t.co/o394nzLlCw
Today we partnered with Meta to disclose a critical vulnerability in React Server Components, impacting Next.js.
Huge credit to Lachlan Davidson for responsibly reporting this to Meta and to our industry partners for responding quickly to our call-to-action.
This is how open source security is supposed to be: responsible disclosure, fast mobilization, and close collaboration.
Within 72 hours, we patched React, shipped WAF mitigations for all Vercel customers, and coordinated major cloud and security providers to protect their customers in the same way.
The united response across the ecosystem has been incredible. AWS, Microsoft, Cloudflare, Fastly, Akamai, F5, Google, Deno, Netlify, Railway, Fly, and others moved quickly with platform protections and clear guidance to their customers.
As a reminder, if you’re running Next.js 15 or 16, please upgrade immediately to 15.5.7 or 16.0.7. Vercel customers have platform-level protections, but upgrading is still a must.
Ref: https://t.co/Y1cVSAjViO
We’ve got confirmation of a working #react2shell POC being shared.
We’ve verified Vercel’s Web Application Firewall is successfully blocking this known variant.
We are also seeing bad actors attempt exploitation. Upgrading React & frameworks remains a top priority.
@JohnTreadway@armon@QuinnyPig@HashiCorp We do. Our privacy policy covers this and here is the direct link to request data download or deletion of your personal data https://t.co/8UBhFxKCVt
We just released our second annual HashiCorp State of Cloud Strategy Survey, with some interesting insight into what enterprises are doing in the cloud. 1/10
@Joseph_Marks_ Basic cybersecurity hygiene matters, ransomware and extortion targets are more than just about money, public and private sector threat information sharing needs to be stronger and supply chain security needs to be top of mind for critical infrastructure
We're thrilled to welcome Talha Tariq (@0xtbt) to our CISO Advisory Board. Talha is the Chief Security Officer at @HashiCorp. He brings 20 years of experience building & scaling security programs from startups to Fortune 100 organizations. Give Talha a warm welcome!
@christophetd@armon@HashiCorp@mitchellh The existing .sig files are currently being left as-is to preserve working behavior on existing Terraform releases. We're in the process of producing patch releases for Terraform which will verify against the new key.
@christophetd@armon@HashiCorp@mitchellh All Terraform binary and provider releases have been signed by the rotated key - those signatures are available at the extension SHA256SUMS.72D7468F.sig
We’re excited to announce that Talha Tariq @0xtbt is our day 1 KEYNOTE for SANS #CloudSecNextSummit!
Join Summit chairs @fykim & @emjohn20 for expert talks on building and maintaining a secure cloud infrastructure.
Register for Free: https://t.co/EBN0nQbrZJ
Join us tomorrow for the Nomad 1.0 launch live stream https://t.co/NO4vww0Asp
Until then the Path to 1.0 continues w/ @KentGruber previewing a new feature. Product security is an important aspect of #Nomad, so we'll introduce a feature to help w/ audits https://t.co/rI4M47CGmN