Talha Tariq

CTO Security @ Vercel. Previously at HashiCorp. Microsoft, PwC. Security researcher & photographer. Views are my own

[Vercel Developers @vercel_dev]

The Vercel security and compute teams have conducted an investigation into the malicious takeover of the 𝚊𝚡𝚒𝚘𝚜@𝟷.𝟷𝟺.𝟷 npm package.

• We’ve blocked outgoing access from our build infrastructure to the Command & Control hostname 𝚜𝚏𝚛𝚌𝚕𝚊𝚔.𝚌𝚘𝚖.
• The malicious version of the package has been blocked and unpublished from npm.
• Vercel’s own infrastructure and applications have been unaffected.
• We recommend checking your supply chain for exposure.

For more information, read the full advisory ↓
https://t.co/o394nzLlCw

[Talha Tariq @0xtbt]

@Menjometre @rauchg Hi, can you try logging in via email instead of Github ?

[Guillermo Rauch @rauchg]

Today we partnered with Meta to disclose a critical vulnerability in React Server Components, impacting Next.js.

Huge credit to Lachlan Davidson for responsibly reporting this to Meta and to our industry partners for responding quickly to our call-to-action.

This is how open source security is supposed to be: responsible disclosure, fast mobilization, and close collaboration.

Within 72 hours, we patched React, shipped WAF mitigations for all Vercel customers, and coordinated major cloud and security providers to protect their customers in the same way.

The united response across the ecosystem has been incredible. AWS, Microsoft, Cloudflare, Fastly, Akamai, F5, Google, Deno, Netlify, Railway, Fly, and others moved quickly with platform protections and clear guidance to their customers.

As a reminder, if you’re running Next.js 15 or 16, please upgrade immediately to 15.5.7 or 16.0.7. Vercel customers have platform-level protections, but upgrading is still a must.

Ref: https://t.co/Y1cVSAjViO

[Guillermo Rauch @rauchg]

We’ve got confirmation of a working #react2shell POC being shared.

We’ve verified Vercel’s Web Application Firewall is successfully blocking this known variant.

We are also seeing bad actors attempt exploitation. Upgrading React & frameworks remains a top priority.

[Oren Yunger @YungerOren]

Loved speaking with Mandy Andress from @elastic, Mario Duarte, from @SnowflakeDB, and Talha Tariq (@0xtbt) from @HashiCorp about their journies from private to public.
@iconbuzz

[Talha Tariq @0xtbt]

@JohnTreadway @armon @QuinnyPig @HashiCorp we do have quiet a bit of automation. There are some manual verification checks that are done by human analysts

[Talha Tariq @0xtbt]

@JohnTreadway @armon @QuinnyPig @HashiCorp We do. Our privacy policy covers this and here is the direct link to request data download or deletion of your personal data https://t.co/8UBhFxKCVt

[The New Stack @thenewstack]

How Drift Detection Helps Maintain a Secure Infrastructure https://t.co/RG5VmYxO8i from @HashiCorp by @0xtbt

[David McJannet @davidmcj]

We just released our second annual HashiCorp State of Cloud Strategy Survey, with some interesting insight into what enterprises are doing in the cloud. 1/10

[Talha Tariq @0xtbt]

@Joseph_Marks_ Basic cybersecurity hygiene matters, ransomware and extortion targets are more than just about money, public and private sector threat information sharing needs to be stronger and supply chain security needs to be top of mind for critical infrastructure

[Torq @torq_io]

We're thrilled to welcome Talha Tariq (@0xtbt) to our CISO Advisory Board. Talha is the Chief Security Officer at @HashiCorp. He brings 20 years of experience building & scaling security programs from startups to Fortune 100 organizations. Give Talha a warm welcome!

[Talha Tariq @0xtbt]

Oregon is beautiful!

[Talha Tariq @0xtbt]

@nomadlogicLA @ryanaraine as mentioned in our disclosure there is no evidence of any malicious change or abuse, our key rotation is a proactive measure

[Talha Tariq @0xtbt]

@christophetd @armon @HashiCorp @mitchellh The existing .sig files are currently being left as-is to preserve working behavior on existing Terraform releases. We're in the process of producing patch releases for Terraform which will verify against the new key.

[Talha Tariq @0xtbt]

@christophetd @armon @HashiCorp @mitchellh All Terraform binary and provider releases have been signed by the rotated key - those signatures are available at the extension SHA256SUMS.72D7468F.sig

[Talha Tariq @0xtbt]

@reneeshah123 @chenxiwang

[SANS Cloud Security @SANSCloudSec]

We’re excited to announce that Talha Tariq @0xtbt is our day 1 KEYNOTE for SANS #CloudSecNextSummit!

Join Summit chairs @fykim & @emjohn20 for expert talks on building and maintaining a secure cloud infrastructure.

Register for Free: https://t.co/EBN0nQbrZJ

[Talha Tariq @0xtbt]

@tomloverro Oh I had no idea - stay blessed and stay healthy ! This world needs people like you

[HashiCorp, an IBM Company @HashiCorp]

Join us tomorrow for the Nomad 1.0 launch live stream https://t.co/NO4vww0Asp

Until then the Path to 1.0 continues w/ @KentGruber previewing a new feature. Product security is an important aspect of #Nomad, so we'll introduce a feature to help w/ audits https://t.co/rI4M47CGmN

[Talha Tariq @0xtbt]

@jefferai @ppacent I can’t wait for redacted !