Vercel
Vercel Confirms a KVM Zero-Day Found by Its Sandbox Bounty
A researcher says he escaped a guest VM to host root. Vercel CEO Guillermo Rauch confirmed the KVM zero-day and promised a full write-up.
Topic
Security
20 articles tagged Security.
Supabase
Supabase Patches 44 Postgres CVEs, Some Fixes Need Your Action
Supabase rolls Postgres 15.19/17.11 out to every project starting today, closing 44 CVEs and flagging four breaking changes that need manual follow-up.
Firebase
Firebase Ships Replay Protection, iOS Apps Can't Use It Yet
Firebase's Admin SDKs finished shipping App Check replay protection, but a FlutterFire bug stops iOS and macOS from getting the short-lived tokens it needs.
Vercel
Next.js ImageResponse Bug Forces an Off-Schedule Critical Patch
Next.js shipped an unscheduled critical RCE patch for ImageResponse (CVSS 9.5), breaking the monthly security cadence Vercel set up in July.
Vercel
Vercel Password Protection Now Costs $20 a Project, Not $150
Vercel replaced its $150-a-month team-wide add-on with $20-per-project Password Protection pricing on Pro, ending a bundle that priced every project at once.
Vercel
Vercel Opens a Private Lane to AWS Databases for Pro Teams
Vercel brings AWS PrivateLink to Pro and Enterprise, letting Functions reach RDS, Aurora and Neon without a public-internet hop.
Vercel
Next.js Patches Two Unauthenticated RCEs in a Single Release
Two critical unauthenticated RCE bugs, one in AVIF image handling and one Windows-only, forced Next.js to patch a day early.
Vercel
Vercel Puts $1M on the Line to Prove Its Sandbox Holds
Vercel is offering hackers up to $50,000 per bug to break Sandbox isolation, weeks after OpenAI agents escaped a sandbox and breached Hugging Face.
Netlify
Netlify SSO Sign-In No Longer Needs a Team ID
Netlify's SSO login now routes on email domain alone, dropping the team ID field that locked out anyone who forgot it.
Firebase
Firebase App Check Brings reCAPTCHA Enterprise to Mobile Apps
Firebase App Check added reCAPTCHA Enterprise as an attestation option for Android, Apple platforms and Flutter, matching the option web apps already had.
Supabase
Supabase Finally Lets You Scope a Personal Access Token
Supabase's alpha for scoped personal access tokens, live since August 10, closes a nearly three-year-old gap where any token controlled the whole account.
Vercel
Vercel Cuts Off GitHub and Google Logins for Enterprise Teams
Vercel's Enterprise Managed Users reached general availability August 11, forcing SAML-only sign-in and directory-managed accounts on company domains.
Vercel
Vercel Patches Sandbox Bug That Let Code Fake Tool Calls
A flaw in Vercel AI SDK's Codex and OpenCode harnesses let sandboxed code invoke host tools without the model ever generating the call.
Supabase
Supabase Stops Honoring Your Pinned Extension Versions
Starting August 5, Supabase ignores explicit version numbers on Postgres extensions and installs the default version instead, closing a security gap.
Vercel
Vercel Puts Internal Apps and AI Agents Behind Your Identity Provider
Vercel Passport reached general availability July 31, gating internal apps and AI agents behind Okta, Entra ID, Auth0 or any OIDC provider.
Netlify
Netlify Makes New Projects Private by Default, Not Existing Ones
New Netlify teams on Credit-based plans now get private projects automatically. Teams that signed up before July 28 keep the old public-by-default behavior.
Netlify
React Router 7.18 Fixes Two Bugs Its Own Patches Missed
React Router 7.18.0 closes a DoS in the manifest endpoint and an open-redirect bypass, both follow-ups to fixes shipped earlier in 2026 that didn't fully hold.
Vercel
Next.js Now Warns You a Patch Is Coming Before It Says Why
Vercel's new Next.js Security Release Program pre-announces patch dates and severity, then ships. Its first drop fixed 9 bugs, 4 of them high severity.
Vercel
Vercel's AI SDK Now Catches MCP Tools That Change After Approval
Vercel's AI SDK adds fingerprintTools and detectToolDrift to catch MCP servers that silently swap a tool's description or schema after an agent trusts it.
Vercel
Vercel Stops Printing Your Secrets Into Build Logs
Vercel now masks Sensitive Environment Variable values in build output automatically, closing a leak into logs teams routinely share and store.