Vercel

Vercel DBSC Session Security Thwarts Cookie Theft

• Technology

Vercel DBSC Session Security Thwarts Cookie Theft

Do Son November 6, 2026 0

Vercel introduced Vercel DBSC session security to tie logins to hardware TPM chips, neutralizing infostealer malware and stolen cookie replay attacks.

PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host

• Vulnerability Report

PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host

Do Son October 19, 2026 0

PwnEscape (CVE-2026-99999) is a critical Linux kernel VM escape that let a guest run code as root on the host in lab tests. Update your kernel now.

Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update

• Vulnerability Report

Next.js Fixes Two Critical Unauthenticated RCE Flaws in Out-of-Band Update

Do Son October 15, 2026 0

The Next.js security update fixes two critical unauthenticated remote code execution flaws, including CVE-2026-96889. Upgrade to 16.4.1 or 15.5.28.

PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545

• Vulnerability Report

PoC Exploit Released for Next.js RCE Flaw CVE-2026-94545

Do Son October 1, 2026 0

Details and PoC exploit code are public for CVE-2026-94545, an unauthenticated Next.js RCE in next/og. Upgrade to Next.js 16.3.6 now.

Critical Next.js RCE Vulnerability Fixed in Version 16.3.6

• Vulnerability Report

Critical Next.js RCE Vulnerability Fixed in Version 16.3.6

Do Son September 23, 2026 0

Vercel fixed a critical Next.js RCE vulnerability in image generation. Update to patch this Next.js RCE vulnerability and secure your apps.

45M Weekly Downloads at Risk: Next.js CVE-2026-75604 (CVSS 9.0) Enables Unauthenticated Remote Code Execution

• Vulnerability Report

45M Weekly Downloads at Risk: Next.js CVE-2026-75604 (CVSS 9.0) Enables Unauthenticated Remote Code Execution

Do Son August 26, 2026 0

Two critical Next.js vulnerabilities, including CVE-2026-75604 (CVSS 9.0), enable unauthenticated remote code execution. Patch to 15.5.24 or 16.3.3 now.

Next.js Patches Three CVSS 8.3 Flaws in Rewrites, Server Actions, and Middleware

• Vulnerability Report

Next.js Patches Three CVSS 8.3 Flaws in Rewrites, Server Actions, and Middleware

Do Son July 23, 2026 0

Three Next.js vulnerabilities (CVE-2026-64645, CVE-2026-64649, CVE-2026-64642) enable Server-Side Request Forgery and middleware bypass. Patch now.

The Next.js Nightmare? Vercel Investigates “Critical” Internal Breach and Supply Chain Threat

• Data Leak

The Next.js Nightmare? Vercel Investigates “Critical” Internal Breach and Supply Chain Threat

Do Son April 19, 2026 0

Vercel investigates a major breach by ShinyHunters. With Next.js source code and tokens at risk, developers must rotate secrets immediately. Stay updated.

Inside Job: Abandoned Outlook Add-in “AgreeTo” Steals 4,000 Credentials

• Malware

Inside Job: Abandoned Outlook Add-in “AgreeTo” Steals 4,000 Credentials

Do Son February 13, 2026 0

Malicious Outlook add-in "AgreeTo" steals 4,000+ credentials. Attackers hijacked the abandoned tool in the official store. Uninstall immediately.

“Browser-in-the-Browser” Attack Escalates: Trellix Reports Surge in Sophisticated Facebook Phishing

• Cybercriminals

“Browser-in-the-Browser” Attack Escalates: Trellix Reports Surge in Sophisticated Facebook Phishing

Do Son January 15, 2026 0

Trellix warns: "Browser-in-the-Browser" phishing creates perfect fake Facebook login pop-ups. Learn how this invisible trap steals credentials.