PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Critical npm supply chain attack response – September 8, 2025

vercel.com | incident | #supply-chain | #cloud-security | #incident-response | #web-security | #vercel
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How Vercel responded to the September 2025 npm supply chain attack on chalk, debug and 16 other packages. Incident timeline, impact analysis, and customer remediation.
Published
Collected

Related coverage

vulnerability · vercel.com
Postmortem on Next.js Middleware bypass
Last week, we published CVE-2025-29927 and patched a critical severity vulnerability in Next.js. Here’s our post-incident analysis and next steps.
vulnerability · vercel.com
The Vercel Bug Bounty Program is now publicly available
Vercel's Bug Bounty Program is now public on HackerOne, covering all Vercel products and open-source projects. Learn how to participate and report findings.
vulnerability · vercel.com
Reproducing, disclosing, and fixing the libheif vulnerability with Hacktron and the maintainers
How Vercel and Hacktron coordinated a fix for a remote code execution vulnerability that reached Next.js image optimization through sharp, libvips, and libheif.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
blog · vercel.com
How we run Vercel's CDN in front of Discourse
Vercel Community uses Vercel as a CDN in front of monolithic servers like Discourse or Wordpress. Use microfrontends to incrementally migrate to a new app.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
Back