Chris LaFleur

sysadmin to Cybersecurity “expert” with just experience of putting one fire out on to the next. Always glad to help USCG-Vet

[Chris LaFleur @TMDFIR]

@ImMeme0 I need to know where this 140/month water bill is at…

[Guillermo Rauch @rauchg]

Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly.

A Vercel employee got compromised via the breach of an AI platform customer called https://t.co/7PY6gGtzgI that he was using. The details are being fully investigated.

Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments.

Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as “non-sensitive”. Unfortunately, the attacker got further access through their enumeration.

We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.

At the moment, we believe the number of customers with security impact to be quite limited. We’ve reached out with utmost priority to the ones we have concerns about. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments. We’ve deployed extensive protection measures and monitoring. We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community.

The recommendation for all Vercel customers is to follow the Security Bulletin closely (https://t.co/BLVnic9fJC). My advice to everyone is to follow the best practices of security response: secret rotation, monitoring access to your Vercel environments and linked services, and ensuring the proper use of the sensitive env variables feature.

In response to this, and to aid in the improvement of all of our customers’ security postures, we’ve already rolled out new capabilities in the dashboard, including an overview page of environment variables, and a better user interface for sensitive env var creation and management. As always, I’m totally open to your feedback.

We’re working with elite cybersecurity firms, industry peers, and law enforcement. We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet. I also want to thank the Google Mandiant team for their active engagement and assistance.

It’s my mission to turn this attack into the most formidable security response imaginable. It’s always been a top priority for me. Vercel employs some of the most dedicated security researchers and security-minded engineers in the world. I commit to keeping you updated and rolling out extensive improvements and defenses so you, our customers and community, can have the peace of mind that Vercel always has your back.

[mert @mert]

i havent laughed at a video this hard for years lmao

[TrendAI @trendaisecurity]

Something big is happening.

Select fearless leaders from @AnthropicAI and TrendAI™ are converging to talk about securing what’s next. 🛡️ Get actionable #AIsecurity insights in a closed-door conversation unlike any other.

Secure your spot: https://t.co/rbN6EFeg9J

[TrendAI @trendaisecurity]

We announced a strategic partnership with @AnthropicAI to enable organizations to adopt AI securely and responsibly.

Together, TrendAI™ and Anthropic are advancing vulnerability discovery while ensuring coordinated action in real-world risk reduction. https://t.co/sxxvG5D4N5

[Chris LaFleur @TMDFIR]

Now @AnthropicAI does a commercial on this is Claude….elevator ride up and full application for a presentation built for you or better yet….as you are walking to the conference room and using the chat system to build for you.

[Computer ♥ Records @ComputerLove_]

Introduction to Microsoft Excel (1992)

[Chris LaFleur @TMDFIR]

If it ain’t ever so true….

[IT Guy @T3chFalcon]

The power of NDAs

[Nick VanGilder @nickvangilder]

Behind the scenes footage

[Chris LaFleur @TMDFIR]

@DylanFedericoWX This is just frame rate matching the wheels turning. Pay attention the wheels move just a little bit backwards and forwards.

[Chris LaFleur @TMDFIR]

@wfaaweather You can check what’s happening with ERCOT app :)

[Chris LaFleur @TMDFIR]

Understand…Santa Monica is just calling me!!!!

#pinkpony banger that exists the Cyber and trade markets refuse to enjoy haha

[TrendAI @trendaisecurity]

Built for AI. Ready for next.

A new era for enterprise security is here. Lead the future of AI with #ProactiveSecurity designed to inspire innovation and eliminate risk.

TrendAI. AI Fearlessly.

#TrendAI #AIfearlessly #NewBrand #ComingSoon

[Chris LaFleur @TMDFIR]

#NewProfilePic

[Chris LaFleur @TMDFIR]

@CyberSecAJ @codegirl007 That is what I was thinking learn what addressable LEDs are and how they operate.

Save them money when they own their own homes on the forever lights

[Chris LaFleur @TMDFIR]

@CyberSecAJ @codegirl007 This right here for each room….

[Chris LaFleur @TMDFIR]

@Cthulhu_Answers @rekdt So you noticed this also that there is always an odd placed chair in hotel rooms…

[Chris LaFleur @TMDFIR]

@DI313_ Happens everyday at DFW…take off and landing happens all tat the same time.

[Chris LaFleur @TMDFIR]

@vxunderground Check your DMs :)

[Chris LaFleur @TMDFIR]

@grok @TheRonHCross @adamscochran And what are the chances that the idea of extending the subsides would be used for political leverage next year in the mid term elections when the democrats attempt to take power of Congress?